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EXECUTIVE  SUMMARY 


This  report  presents  the  results  of  a  study,  funded  by  the  Federal  Aviation  Administration  (FAA), 
of  crash-resistant  fuel  system  (CRFS)  technology  for  large  transport  category  airplanes. 
Research  efforts  over  the  years  led  to  the  development  and  installation  of  CRFSs  in  all  U.S. 
Army  helicopters,  resulting  in  the  virtual  elimination  of  postcrash  fire  fatalities  in  Army 
helicopter  accidents.  The  transference  of  this  technology  to  civil  aircraft  has  been  very  slow. 
Although  the  level  of  fuel  system  crash  resistance  in  civil  helicopters  has  been  improved  during 
recent  years,  very  little  has  been  done  for  fixed-wing  aircraft  of  any  size.  The  focus  of  this  study 
is  to  assess  the  status  of  CRFS  technology  in  current  large  transport  category  airplanes  and  to 
provide  recommendations  for  the  integration  of  available  state-of-the-art  CRFS  technology  into 
those  airplanes. 

Efforts  to  understand  the  postcrash  fire  problem  of  large  airplanes  and  to  improve  the  crash 
resistance  of  their  fuel  systems  began  over  50  years  ago  with  research  and  test  efforts  conducted 
by  the  National  Advisory  Committee  for  Aeronautics  (NACA)  National  Aeronautical  and  Space 
Administration  (NASA)  and  Civil  Aviation  Authority  (CAA)  FAA.  The  U.S.  Army  began  its 
efforts  to  develop  CRFSs  for  its  helicopters  and  small  fixed-wing  aircraft  40  years  ago  and  began 
installing  them  in  production  helicopters  10  years  later.  These  efforts  are  summarized  in  some 
detail  to  provide  the  reader  with  a  firm  background  in  the  principles  of  CRFS  design  as  well  as  in 
the  technology  which  was  developed. 

The  transference  of  the  CRFS  technology  to  large  transport  category  airplanes  is  not  simple.  The 
fuel  systems  of  current  large  transport  airplanes  are  much  more  complex  and  varied  than  those  in 
the  small  fixed-wing  and  helicopter  structures.  The  vast  difference  in  size  poses  a  problem  in 
establishing  simple  design  criteria  for  a  generic  CRFS  for  large  transport  airplanes.  Whereas  the 
structure  and  all  the  occupants  of  smaller  aircraft  experience  roughly  the  same  crash 
environment,  this  is  not  the  case  in  the  larger  transport  airplanes.  These  are  significant 
differences  in  the  structural  damage  suffered,  and  in  the  resultant  crash  loads  transmitted  to  the 
occupants,  in  various  parts  of  these  large  aircraft.  As  a  result,  the  diversity  of  the  crash 
environment  in  which  a  CRFS  must  function  successfully  is  extensive.  For  this  reason,  CRFS 
design  criteria  might  better  be  established  based  upon  anticipated  structural  displacement 
coupled  with  anticipated  crash  loads,  based  on  typical  crash  scenarios  as  determined  by  detailed 
crash  investigations  and  test  programs,  rather  than  crash  loads  alone.  In  any  case,  what  little 
crash  testing  has  been  done  on  large  transport  airplanes  clearly  shows  that  the  crash  G  loads 
specified  by  current  regulations  are  not  adequate.  The  testing  also  shows  that  current  large 
transport  fuselage  auxiliary  fuel  tanks  cannot  withstand  survivable  crash  scenarios  without 
leaking. 

A  review  of  the  available  accident  data  is  of  little  help  in  establishing  the  level  of  current  fuel 
system  crash  performance.  Although  the  occurrence  of  fire  is  reported  in  the  accident  reports, 
the  number  of  fatalities  caused  by  the  fire,  as  opposed  to  impact,  is  often  not  available  or  is 
unreliable.  The  effect  of  the  crash  on  the  fuel  system  and  its  components  is  not  reported. 
Similarly,  the  reports  on  structural  damage  are  inadequate  to  establish  crash  vectors,  crash  forces, 
structural  displacements,  and  other  necessary  structural  behavior  patterns.  The  inadequacy  of 
current  available  crash  data  underscores  the  need  for  the  training  of  field  investigators  in  specific 
crashworthiness  technology  and  data  collection. 
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CRFS  design  principles  and  technology  are  described  and  discussed  together  with  the  status  of 
CRFS  technology  implementation  in  current  large  transport  airplanes.  Some  CRFS  components 
and  subsystems  could  be  integrated  immediately  with  minimal  impact  on  design.  However, 
there  are  many  areas  of  CRFS  design  that  require  more  research  before  they  can  be  implemented 
in  large  transport  airplanes.  False  information,  not  critically  challenged,  has  retarded  the 
development  of  some  easily  accomplished  CRFS  improvements. 

Current  and  proposed  regulations  applicable  to  large  transport  fuel  systems  are  summarized  and 
analyzed  with  respect  to  CRFS  designs.  The  impact  of  the  new  “Mega- AC”  system  is  discussed. 

This  report  provides  information  to  the  FAA  and  other  governmental  organizations  that  can 
assist  their  efforts  to  improve  the  crash  resistance  of  large  transport  category  airplane  fuel 
systems. 
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1.  INTRODUCTION. 


Postcrash  fires  account  for  a  high  percentage  of  injuries  and  fatalities  in  aircraft  accidents  that 
would,  in  the  absence  of  such  fires,  be  survivable.  The  successful  development  and 
implementation  of  crash-resistant  fuel  systems  by  the  U.S.  Army  in  its  rotorcraft  fleet  has  proven 
that  technology  is  available  to  virtually  eliminate  fire  fatalities  in  otherwise  survivable  helicopter 
accidents.  The  transference  of  this  technology  to  civil  aircraft  has  been  slow  in  the  several 
decades  since  the  Army  implemented  this  technology.  Although  the  level  of  crash  resistance  in 
some  civil  helicopters  has  been  improved  over  the  years,  progress  has  been  uneven.  Very  little 
has  been  done  for  fixed-wing  aircraft  of  any  size. 

Efforts  to  understand  the  postcrash  fire  problem  of  large  airplanes  and  to  improve  the  crash 
resistance  of  their  fuel  systems  began  over  50  years  ago  with  research  and  test  efforts  conducted 
by  the  National  Advisory  Committee  for  Aeronautics  (NACA),  National  Aeronautical  and  Space 
Administration  (NASA),  Civil  Aviation  Authority  (CAA),  and  Federal  Aviation  Administration 
(FAA).  The  FAA  has  been  active  in  this  effort  ever  since  and,  in  1989,  issued  an  Advanced 
Notice  of  Proposed  Rulemaking  (ANPRM  89-11)  to  determine  the  feasibility  of  installing,  in  all 
air  carrier  aircraft,  crashworthy  fuselage  fuel  tanks  and  fuselage  fuel  lines  which  are  rupture 
resistant  and  which  disconnect  and  seal  in  the  event  of  an  accident.  Although  no  further 
rulemaking  has  been  proposed,  the  FAA  is  still  desirous  of  improving  the  crash  resistance  of 
transport  airplane  fuel  systems  and  would  like  to  issue  a  new  NPRM  to  implement  available 
crashworthy  technology  into  current  versions  of  transport  category  airplanes. 

To  support  this  effort,  the  FAA  contracted  with  Robertson  Aviation  to  assess  the  current  crash- 
resistant  fuel  system  (CRFS)  technology  applicable  to  Title  14  Code  of  Federal  Regulations 
(CFR)  Part  25  transport  category  airplanes  and,  based  on  this  assessment,  to  recommend  future 
testing  and  changes  necessary  to  implement  CRFS  technology  into  transport  airplanes.  The 
scope  of  this  program  included  the  review  and  evaluation  of  (1)  prior  historical  studies  in  aircraft 
fire  research,  (2)  design  and  test  efforts  associated  with  CRFS  components  and  fuel  containment 
concepts,  (3)  available  crash  test  data  for  transport  category  aircraft,  and  (4)  pertinent  transport 
airplane  crash  reports  and  data.  Fuel  system  designs  and  CRFS  technology  currently  used  in 
transport  airplanes  were  to  be  documented  and  their  probable  behavior  in  typical  survivable 
accidents  analyzed.  Current  CRFS  technology  was  to  be  compared  with  available  state-of-the- 
art  fuel  system  technology  and  recommendations  made  for  the  integration  of  CRFS  technology 
into  current  transport  airplane  designs.  Recommendations  also  were  to  be  proposed  for  future 
testing  that  would  provide  sufficient  data  for  the  issuance  of  a  new  NPRM. 

This  report  begins  in  section  2  with  a  summary  and  analysis  of  the  history  of  CRFS 
development,  including  work  done  by  NASA,  the  FAA,  and  the  U.S.  Army.  The  implementation 
of  CRFS  technology  into  military  and  civil  rotorcraft  and  the  ongoing  efforts  to  improve  the 
crash  fire  safety  of  fixed-wing  aircraft  are  discussed. 

Section  3  reviews  and  analyzes  the  available  data  from  crash  tests  of  modem  transport  airplanes 
for  its  applicability  to  CRFS  design.  Additional  testing  under  varying  conditions  is  identified. 

Transport  airplane  accident  data  studies  are  reviewed  in  section  4.  Emphasis  is  on  those  of  the 
jet  transport  era,  and  a  number  of  special  studies  and  reports  from  committees  established  for  this 
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purpose  are  summarized.  Some  significant  accidents  during  the  recent  past  are  reviewed.  The 
roles  that  accident  data  and  its  collection  play  in  CRFS  development  also  are  discussed, 
including  the  inadequacy  of  current  available  data. 

Section  5  reviews  the  general  design  of  transport  aircraft  fuel  systems,  with  descriptive 
examples.  There  is  an  incredibly  wide  variety  of  designs.  Many  new  aircraft  are  entering  the 
market  with  new  features,  like  fuel  in  the  horizontal  tail  section,  that  make  the  overall  design 
problem  much  more  difficult  than  in  helicopters. 

Current  CRFS  design  principles  and  technology  are  described  and  discussed  in  section  6,  along 
with  the  status  of  CRFS  technology  implementation  in  current  transport  airplanes.  A  matrix 
illustrating  current  fuel  systems  used  in  transport  category  airplanes  versus  available  state-of-the- 
art  CRFS  technology  is  provided.  This  matrix  highlights  those  areas  most  in  need  of 
improvement. 

CRFS  evaluation  methods  are  contained  in  section  7.  A  rating  system  is  described  to  evaluate 
the  postcrash  fire  potential  of  a  fuel  system.  Although  developed  for  small  fixed-wing  and 
helicopter  fuel  systems,  this  rating  system,  when  suitably  modified,  would  be  very  valuable  in 
assisting  the  designer  of  a  transport  airplane  CRFS.  The  section  also  contains  an  evaluation 
technique  that  can  determine  the  relative  “fire  hazard  level”  for  each  fuel  system  component 
and/or  hazardous  area.  This  technique  allows  the  designer  to  make  optimum  selection  of  designs 
and  components. 

Section  8  summarizes  and  analyzes  civil  and  military  standards  applicable  to  CRFS  for  transport 
category  airplanes.  The  impact  of  the  new  “Mega- AC”  system  is  discussed. 

Conclusions  of  the  study  are  presented  in  section  9. 

Recommendations  resulting  from  the  study  are  presented  in  section  10. 

References  used  in  the  study  are  presented  in  section  11. 

A  bibliography  of  related  literature  is  presented  in  section  12. 
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2.  REVIEW  OF  POSTCRASH  FIRE  RESEARCH. 


2.1  BACKGROUND. 

Early  efforts  of  the  CAA  (FAA)  to  combat  aviation  fires  involved  efforts  to  reduce  in-flight 
engine  fires.  With  the  advent  of  turbine  engines  and  pod-mounts  below  the  wing,  in-flight  fire 
risk  declined.  This  led  to  a  switch  in  emphasis  to  postcrash  fires,  although  some  work  continued 
on  flight  fire  hazards  [1].  The  postcrash  fire  effort  was  precipitated  by  statistical  studies  of 
airplane  accidents  which  showed  that  those  accidents  with  postcrash  fires  had  a  much  higher 
fatality  rate  than  those  without  fires.  For  instance,  the  1946  statistics  on  U.S.  air  carrier  accidents 
showed  that  fire  followed  13  percent  of  all  accidents  and  that  approximately  30  percent  of  the 
passengers  involved  in  those  accidents  were  killed  as  a  result  of  the  fire.  Two  to  three  times  as 
many  people  were  being  killed  in  fire  accidents  as  in  non-fire  accidents  [2], 

At  the  Aircraft  Fire  Protection  Conference  in  June  1946,  the  CAA’s  Technical  Development 
Center  proposed  two  test  programs  to  determine  the  causes  of  failure  of  existing  fuel  tanks 
subjected  to  crash  loads  [3].  One  program,  which  involved  impact  and  deceleration  testing  of 
existing  wing  fuel  tank  structures,  was  funded  and  the  initial  test  program  was  completed  in 
1950.  Additional  programs  followed,  including  a  series  of  full-scale  aircraft  crash  tests 
conducted  by  NACA  (NASA)  to  better  define  the  postcrash  fire  problem  and  develop  methods  of 
reducing  or  eliminating  these  fires. 

The  increasing  use  of  rotary- wing  aircraft  in  military  and  civilian  operations  prompted  similar 
studies  to  determine  the  hazard  of  postcrash  fires  in  accidents  with  helicopters.  A  1961  study  of 
major  accidents  involving  both  civilian  and  military  helicopters  showed  that,  although  only  8.7 
percent  of  the  accidents  resulted  in  fire,  60.4  percent  of  all  the  fatalities  occurred  in  those  fire 
accidents  [4],  Similar  results  were  found  in  an  analysis  of  U.S.  Army  helicopter  accidents  from 
July  1957  to  June  1960.  Seven  percent  of  the  579  accidents  examined  resulted  in  postcrash  fires, 
but  63  percent  of  the  fatalities  occurred  in  those  postcrash  fire  accidents  [5].  The  study  also 
found  that  78.5  percent  of  the  postcrash  fires  could  be  attributed  to  ruptured  fuel  cells  and/or  fuel 
lines. 

In  September  1959,  the  U.S.  Army  Transportation  Command  funded  a  1-year  contract  with  the 
Flight  Safety  Foundation  to  conduct  research  generally  in  fields  related  to  Army  Aviation  Safety, 
with  particular  reference  to  crash  injury  and  crashworthiness  programs.  The  work  was  to  be 
conducted  largely  by  Aviation  Crash  Injury  Research  (AvCIR),  a  division  of  the  Foundation  in 
Phoenix,  Arizona.  Thus  began  a  collaboration  that  was  to  continue  for  over  10  years  and  would 
result,  among  other  crashworthy  improvements,  in  the  development,  design,  and  installation  of 
crash-resistant  fuel  systems  in  the  entire  fleet  of  U.S.  Army  helicopters. 

Concurrent  with  the  development  effort  for  helicopter  CRFS  by  AvCIR  and  the  U.S.  Army,  the 
FAA  was  continuing  research  into  the  crash  resistance  of  transport  aircraft  fuel  systems.  In  the 
1970s,  a  10-year  program  was  begun,  in  cooperation  with  NASA,  to  improve  the 
crashworthiness  of  general  aviation  aircraft.  Following  this  effort,  the  FAA  again  turned  its 
attention  to  improving  the  crash  resistance  of  transport  airplane  fuel  systems  -  an  effort  that 
continues  to  this  day. 
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The  history  of  this  overall  fire  research  effort,  which  has  spanned  more  than  50  years,  is 
summarized  in  some  detail  in  the  remainder  of  this  section.  The  abbreviated  history  outlined  in 
figure  2-1  may  assist  the  reader  in  relating  the  various  projects  to  time  and  to  each  other. 

2.2  DEFINING  THE  POSTCRASH  FIRE  PROBLEM. 

2.2.1  Airplane  Crash  Testing. 

Studies  to  define  the  causes  of  aircraft  postcrash  fires  and  the  specific  hazards  such  fires  pose  to 
the  occupants  began  in  1924  during  crash  tests  of  United  States  Army  DH-4  aircraft  used  to  carry 
mail.  By  removing  ignition  sources  from  areas  of  anticipated  fuel  spillage,  crash  fires  were 
prevented.  While  these  and  other  efforts,  such  as  the  selective  placement  of  fuel  tanks,  offered 
some  help  in  reducing  the  postcrash  fire  problem,  the  first  major  scientific  effort  to  address  the 
problem  in  detail  began  in  the  late  1940s  with  several  test  programs  conducted  by  the  CAA  and 
NACA  in  conjunction  with  the  U.S.  Air  Force. 

NACA  proposed  in  1948  that  full-scale  crash  tests  be  conducted  to  determine  if  the  use  of  low- 
volatility  fuel  offers  significant  safety  benefits  over  gasoline  and  to  obtain  further  information  on 
the  origin  and  propagation  of  fire  during  crashes  [2],  Subsequently  a  series  of  17  full-scale  crash 
tests  was  conducted  using  low-wing  (C-46)  and  high-wing  (C-82)  twin-engine  cargo  transport 
airplanes  [6],  All  the  airplanes  had  reciprocating  engines  and  most  tests  used  gasoline  but  some 
used  low-volatility  fuel.  The  tests  were  structured  to  simulate  a  takeoff  accident  in  which  the 
plane  fails  to  become  airborne.  The  airplanes  were  accelerated  along  a  guide  rail  under  their 
own  power,  and  then  released  just  before  impacting  an  earthen  barrier,  which  tore  off  the  landing 
gear  and  displaced  the  engines  and  nacelles.  The  airplanes  then  struck  embedded  poles  designed 
to  rupture  the  wing  fuel  tanks  and  the  airplanes  slid  along  the  ground  until  they  stopped.  Impact 
speeds  were  80  to  105  mph. 

These  pioneering  tests  showed  that  fuel  spilled  in  liquid  form  from  broken  fuel  lines  and  tanks 
formed  a  fuel  mist  around  the  plane  while  the  plane  was  in  motion.  Depending  on  the  nature  of 
the  aircraft  deceleration  phase,  the  fuel  mist  could  be  projected  ahead  of  the  slowing  aircraft,  it 
could  surround  the  slowing  aircraft,  or  the  fuel  mist  could  trail  behind.  Fuel  spillage  from  the 
leading  edge  of  the  wing  could  attain  appreciable  spanwise  spread  as  a  mist  forward  of  the 
leading  edge.  A  spilled  mist  fuel  usually  surrounded  the  aircraft  wreckage  after  it  came  to  rest. 
The  mist  generally  dissipated  within  2  to  1 7  seconds  after  the  plane  stopped,  depending  on  wind 
speed.  Ignition  of  the  mist  occurred  in  as  little  as  0.6  second  after  impact.  Flames  spread  rapidly 
through  the  mist  (as  fast  as  45  ft/sec)  as  the  flame  front  velocity  was  accelerated  by  the 
expanding  burning  mass  of  fuel  and  air.  The  tests  also  showed  that  the  use  of  low-volatility  fuel 
did  not  prevent  ignition  or  fire. 
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FIGURE  2-1.  ABBREVIATED  HISTORY  OF  AIRCRAFT  FIRE  RESEARCH 


Ignition  sources  determined  during  the  tests  were: 

a.  hot  surfaces  (e.g.,  exhaust  system,  heat  exchangers,  etc.) 

b.  friction  sparks  from  abraded  airplane  metals 

c.  engine  -  exhaust  flames 

d.  engine  induction  system  flames 

e.  electric  arcs,  electrically  heated  wiring,  and  lamp  filaments 

f.  flames  from  burning  hydraulic  fluid,  engine  oil,  and  alcohol 

g.  electrostatic  sparks 

The  work  on  the  origin  of  crash  fires  was  extended  to  jet  aircraft  soon  thereafter.  The  ignition 
hazards  of  electrical  and  friction  sparks  and  air  heaters  were  the  same  as  for  piston  aircraft.  New 
elements  were  the  jet  engines  and  jet  fuels.  This  effort  began  with  two  full-scale  crash  tests;  one 
utilizing  a  C-82  with  pylon-mounted  jet  engines  underneath  the  wings  and  one  using  an  F-84 
with  its  jet  engine  located  within  the  fuselage  [7],  Test  conditions  were  similar  to  those 
described  above.  Both  crashes  resulted  in  fires  when  fuel  mist  ingested  into  the  engines 
produced  flames  at  the  engine  inlet  and  tailpipe,  igniting  misted  fuel  spilled  from  the  wings.  The 
fuel  was  ignited  inside  the  engine  by  combustion  flame  or  hot-metal  surfaces. 

A  crash  fire  protection  system  was  designed  that  disconnected  the  electrical  system,  closed  the 
fuel  shutoff  valve,  and  sprayed  water  on  hot  engine  parts.  All  were  activated  by  a  crash- 
activated  switch.  There  were  no  fires  with  this  system  installed  during  six  full-scale  crash  tests. 


NACA  had  also  advocated  in  1948  that  efforts  be  continued  on  fuel  system  configurations  and 
construction  methods  to  contain  fuel  during  a  crash.  An  extensive  test  series  was  being 
conducted  at  this  time  by  the  CAA  to  determine  the  effectiveness  of  fixed-wing  integral  tanks 
and  conventional  bladder-cell  tanks  in  containing  fuel  during  crashes  [8].  The  test  program 
consisted  of  three  basic  test  series  of  wing  sections,  including  fuel  tanks.  These  tests  were  (1) 
deceleration;  (2)  impact;  and  (3)  deformation.  The  first  two  test  series  were  conducted  with  the 
wing  tanks  mounted  on  a  carriage  accelerated  down  a  test  track;  the  first  with  the  wing  tank 
rigidly  attached  to  the  carriage  and  the  second  with  the  wing  tank  catapulted  from  the  carriage 
into  a  flat  sandbag  surface.  The  deformation  tests  consisted  of  torsional  and  bending  tests 
conducted  in  a  test  rig. 

The  results  of  these  tests  showed  that,  although  integral  tanks  could  withstand  over  20-G 
acceleration  in  the  absence  of  a  direct  impact  (resulting  in  fluid  pressures  of  30  to  40  psi),  they 
had  very  low  resistance  to  direct  impacts.  The  tests  also  showed  that  the  current  bladder  cells 
had  low  strength  and  inadequate  stretching  capability  (low  elongation).  Thus,  the  cell  walls 
could  not  withstand  the  dynamic  pressure  loads  when  support  of  the  surrounding  structure  was 
lost. 


The  CAA  investigators  concluded  that  no  current  fuel  tank  had  any  crash-resistant  characteristics 
to  any  appreciable  degree  and  no  particular  type  of  tank  was  better.  They  also  concluded  that 
any  type  of  wing  tank  was  safer  if  (1)  it  was  located  outboard  in  the  wing  where  the  wing  was 
not  likely  to  break  off;  (2)  a  center  spar  was  used  to  separate  tanks  fore  and  aft;  (3)  the  wing  was 
protected  from  ground  contact  by  low  nacelles  or  other  structure;  (4)  heavy  front  spars  and 
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leading-edge  structures  were  incorporated  into  the  wing;  and  (5)  landing  gear  loads  were  not 
applied  directly  to  the  tank  structure. 

The  first  two  full-scale  crash  tests  of  commercial  transport  airplanes  were  conducted  for  the  FAA 
by  Aviation  Safety  Engineering  and  Research  (AvSER,  formerly  AvCIR)  in  1964  [9  and  10]. 
The  test  program  was  designed  to  simulate  typical  conditions  during  survivable  takeoff  and 
landing  accidents  and  to  collect  data  on  crash  loads,  accelerations,  and  fuel  containment.  The 
airplanes  (a  DC-7  and  a  Lockheed  Constellation,  Model  1649)  were  guided  into  a  series  of  crash 
barriers  using  a  monorail  nose-gear  guidance  system.  The  aircraft  were  accelerated  under  their 
own  power  by  remote  control.  Initial  impact  was  against  low  barriers,  which,  removed  the 
landing  gear,  allowing  the  aircraft  to  become  airborne  (see  figure  2-2).  Subsequently  the  left 
wing  impacted  an  earthen  mound  shaped  to  produce  a  simulated  wing-low  accident  while  the 
right  wing  struck  vertical  telephone  poles  simulating  trees.  The  fuselage  then  struck  an  upward 
slope  (8°  for  the  DC-7,  6°  for  the  Constellation),  becoming  airborne  again  until  striking  a  20° 
slope  to  simulate  a  steeper  impact  angle.  The  aircraft  then  slid  to  a  stop.  Impact  speeds  were 
139  kts  for  the  DC-7  and  1 12  kts  for  the  Constellation. 


POINT 


FIGURE  2-2.  PLAN  VIEW  OF  TEST  SITE  FOR  DC-7  AND  CONSTELLATION 

CRASH  TESTS 
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The  DC-7  had  both  integral  and  bladder  fuel  tanks  while  the  Constellation  had  only  integral 
tanks.  One  tank  in  each  wing  was  filled  with  dyed  gelled  water  while  the  rest  of  the  tanks  were 
filled  with  dyed  liquid  water.  Only  the  minimal  amount  of  fuel  necessary  to  conduct  the  test  was 
onboard  in  an  auxiliary  tank  mounted  in  a  location  safe  from  impact.  Even  so,  fuel  and  oil  lines 
were  ruptured  when  the  engines  were  tom  free  in  the  DC-7  crash.  A  heavy  mist  of  fuel  and  oil 
ignited  and  burned  for  several  seconds,  illustrating  the  ignition  potential  of  the  engine  and  the 
ease  of  ignition  of  fuel  mists. 

The  wings  of  both  aircraft  suffered  extensive  damage,  especially  the  right  wings  from  the 
localized  impacts  of  the  poles.  Both  wings  of  the  DC-7  broke  at  the  wing  roots  and  the  outer 
panel  of  the  right  wing  was  sheared  off.  The  left  wing  of  the  Constellation  was  partially 
separated  at  the  wing  root  and  the  outer  panel  of  the  right  wing  was  sheared  off.  In  addition,  the 
right  wing  of  the  Constellation  was  partially  separated  between  the  engine  nacelles  by  the  pole 
impact,  finally  separating  completely  as  the  aircraft  slid  along  the  ground.  All  of  the  fuel  tanks 
in  both  tests  were  damaged  and,  in  some  cases  involving  pole  impacts,  destroyed.  Massive 
spillage  occurred  from  the  tanks.  Spilled  fuel  (H20)  and  mist  surrounded  the  aircraft  to  a  large 
extent,  both  while  in  motion  and  after  coming  to  rest.  (Figure  2-3  illustrates  the  spillage  pattern 
of  the  Constellation.) 


4.  Right  outboard  wing  tank  (water) 

FIGURE  2-3.  VISIBLE  FUEL  SPILLAGE  OCCURRING  2.24  seconds  AFTER 
CONSTELLATION  IMPACT  WITH  MAIN  GEAR  BARRIERS 
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The  gelled  water  was  expelled  immediately  from  both  the  DC-7  and  Constellation  right  wing 
fuel  tanks  which  were  subjected  to  direct  pole  impacts.  However,  it  took  2  hours  for  the  gelled 
fuel  to  drain  from  the  left  wing  tank  of  the  Constellation,  which  suffered  spanwise  cracks  in  the 
bottom  of  the  tank  and  a  tom  top. 

The  behavior  of  the  two  aircraft  structures  during  the  tests  were  quite  different.  The  DC-7 
structure  was  of  the  older  design  technique  using  relatively  ductile  skin  supported  by  longerons, 
etc.  The  Constellation  used  a  newer  stressed  skin  design  incorporating  high-strength,  relatively 
low  elongation,  aluminum  similar  to  today’s  aircraft.  In  addition,  the  Constellation  Model  1649 
contained  a  totally  new  wing  of  increased  span  incorporating  huge  chemically  milled,  machined 
skins.  The  brittle  Constellation  structure  broke  into  many  small,  jagged  pieces  of  metal  on 
impact,  as  contrasted  to  the  DC-7  structure,  which  tended  to  crumple,  crush,  and  tear.  The 
greater  hazard  of  jagged,  broken  stmcture  (versus  cmmpled  structure)  to  the  survival  of 
nonintegral  fuel  tanks  is  an  area  of  concern  in  transport  airplanes. 

Even  with  the  differences  in  aircraft  stmcture,  these  tests  resulted  in  very  similar  mechanisms 
and  patterns  of  fuel  spillage  as  occurred  in  the  earlier  tests  of  smaller  and  older  airplanes.  These 
common  patterns  allow  the  construction  of  a  general  model  of  fuel  system  damage,  spillage,  and 
mist  formation  that  occurs  in  typical  large  transport  airplane  accident  scenarios.  Thus,  it  should 
be  possible  to  derive  solutions  to  the  postcrash  fire  problem  that  are  universally  applicable  to 
large  transport  airplanes,  although  implementation  into  specific  airplanes  would  necessitate 
varying  detailed  designs. 

2.2.2  Helicopter  Crash  Testing. 

Although  the  FAA  had  conducted  six  helicopter  drop  tests  by  1959,  these  tests  were  designed 
primarily  to  measure  structural  load  factors  during  crashes  [11].  The  crash  tests  conducted  by 
AvCIR  for  the  U.S.  Army  in  the  early  1960s  were  the  first  designed  to  determine  the  behavior  of 
helicopter  fuel  systems  during  crashes.  The  first  of  what  would  eventually  be  over  40  crash  tests 
was  conducted  in  October  1960  [12].  This  test  consisted  of  a  moving  crane  drop  of  a  twin-rotor, 
light-cargo  helicopter  with  test  conditions  simulating  severe  but  survivable  conditions  (forward 
velocity  of  30  mph,  30-foot  drop  height).  High-speed  on-board  and  ground-based  cameras 
documented  the  test  and  allowed  visual  analysis  of  events  occurring  during  the  crash.  The  test 
was  designed  to  measure  structural  loads,  seat  restraint  and  test  dummy  loads,  and  to  determine 
the  performance  of  the  regular  fuel  system  and  an  experimental  range  extension  fuel  tank  carried 
in  the  right-hand  seat.  The  seats  collapsed  during  the  impact  and  the  range  extension  fuel  tank 
was  ruptured  in  several  places,  resulting  in  large  amounts  of  fuel  spillage  in  and  around  the 
helicopter.  The  regular  fuel  system  was  not  ruptured.  More  importantly,  the  test  proved  that  this 
was  a  satisfactory  and  inexpensive  method  for  crash  testing. 

Four  more  helicopter  crash  tests  were  conducted  in  the  following  year,  all  using  the  same  test 
methodology  that  was  used  in  the  first  test  [4].  The  basic  purpose  of  these  tests  was  to  obtain 
acceleration  and  force  data  to  define  the  survivable  crash  environment.  This  would,  in  turn,  help 
the  aircraft  designer  develop  better  components  such  as  seats,  restraint  systems,  and  fuel  systems. 

Meanwhile,  in-depth  investigations  of  U.S.  Army  helicopter  accidents  began  in  the  1950s  and 
would  extend  through  the  1960s.  These  numerous  accident  investigations,  coupled  with  full- 
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scale  crash  tests,  were  detailing  some  of  the  most  common  fuel  system  failures  that  occurred 
during  helicopter  crashes.  These  were 

a.  Many  helicopter  fuel  tanks  were  located  low  in  the  structure  and/or  very  near  the  outer 
surface  of  the  aircraft,  subjecting  them  to  severe  loads.  Additional  loads  could  be  added 
by  heavy  cargo  and,  in  some  cases,  by  the  engine  or  transmission.  These  loads  would 
cause  the  tanks  to  rupture  during  the  crash. 

b.  The  tank  would  be  punctured  by  jagged  metal  and  broken  components  of  the  failing 
structure.  When  puncture  coincided  with  the  high-pressure  loading  of  the  tank 
experienced  during  the  crash,  the  fuel  tank  wall  would  tear.  This  tear  would  progress 
rapidly  away  from  the  point  of  puncture. 

c.  Fuel  tank  fittings  would  be  tom  from  the  tank  wall  as  the  structure  moved  relative  to  the 
tank. 

d.  Fuel  lines  would  be  cut  or  tom  apart  if  they  were  located  in  areas  of  displacing  or  failing 
structure. 

From  this  knowledge,  a  system  was  developed  to  allow  evaluation  of  the  crash  survival  potential 
of  a  fuel  system  even  though  no  accident  record  was  available  for  that  aircraft.  Four  crash  tests 
were  conducted  on  OH-4A  and  OH-5A  helicopters  after  they  had  been  evaluated  in  flyable 
condition  [13  and  14],  The  fuel  systems  were  re-evaluated  after  the  crash  tests  and  close 
correlations  between  the  pre-  and  posttest  evaluations  occurred  in  every  case.  The  authors 
concluded  that  a  trained  evaluator  could  reliably  evaluate  the  crash  survival  potential  of  an 
aircraft  fuel  system  in  the  absence  of  accident  data  and  that  reliable  estimates  could  be  made 
even  during  the  design  stages  of  a  specific  aircraft.  This  evaluation  system  has  been  refined  over 
the  years  and  is  currently  in  use  today  (see  section  7). 

2.2.3  The  Postcrash  Fire  Environment. 

NACA  was  the  first  (in  1953)  to  investigate  and  quantify  the  postcrash  fire  environment  and  to 
determine  available  escape  times  based  on  this  data  [15].  The  data  were  obtained  from  the  full- 
scale  airplane  crash  tests  previously  conducted  and  from  supplemental  bums  of  aircraft  hulks.  It 
included  measurements  of  the  radiant  heat,  ambient  air  temperatures,  and  concentrations  of 
carbon  monoxide  (CO).  Escape  times  were  calculated  from  the  measured  data  and  known 
human  tolerance  levels.  (Escape  time  from  thermal  injury  was  based  on  the  skin  temperature 
which  resulted  in  severe  pain  and  second  degree  burning.)  Escape  times  based  on  thermal  injury 
varied  from  50  to  300  seconds,  depending  on  the  position  of  the  occupant  in  relation  to  the  fire, 
size  of  the  fire,  and  environmental  conditions  at  the  crash  site.  It  was  found  that  fuel  volatility 
did  not  affect  escape  times  when  fuel  mists  occurred,  as  happens  during  most  aircraft  crashes. 
Escape  time  based  on  CO  concentration  was  longer  than  for  thermal  injury,  although  the  times 
did  not  differ  greatly. 

The  NACA  investigation  also  studied  the  effects  of  insulation  on  fuselage  skin  bum  through 
times.  Two  identical  enclosures,  one  insulated  with  2  in.  of  glass  wool  held  in  place  with  a  thin 
insulation  and  fabric  pad  and  one  uninsulated,  were  subjected  to  ground  fuel  fires.  The  study 
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found  that  the  temperatures  in  the  insulated  enclosure  remained  below  those  in  the  uninsulated 
enclosure  initially,  but,  after  7  1/2  minutes,  the  insulated  enclosure  burned  through  and  then 
temperatures  increased  rapidly.  The  uninsulated  enclosure  did  not  bum  through  until  12  minutes 
after  the  fire  started.  The  investigators  surmised  that  the  insulation  prevented  the  reradiation  of 
heat  from  the  opposite  skin  surface,  as  occurs  with  uninsulated  skin.  However,  the  validity  of 
this  data  to  current  aircraft  with  improved  interior  materials  and  different  types  of  insulation 
must  be  questioned. 

Subsequent  studies  determined  that  0.035-inch-thick  fuselage  skin  burned  through  in  63  sec  [16]. 
The  temperature  inside  the  cabin  did  not  rise  until  bum  through  occurred.  Interior  materials  were 
the  most  important  factor  affecting  the  fire  hazard  once  bum  through  occurred  or  flames  entered 
through  structural  openings.  Gases  generated  from  burning  materials  can  lead  to  a  flash  fire 
(flashover)  in  only  a  few  minutes.  In  addition  to  toxic  gases,  large  quantities  of  smoke  are 
generated  from  burning  fuel,  oil,  hydraulic  fluid,  and  interior  materials.  This  smoke  obscures 
vision  and  makes  breathing  difficult. 

More  recent  bum  tests  (1989)  of  contemporary  transport  airplane  structures  with  newer,  more 
fire-resistant  interior  materials  showed  that  skin  bum  through  still  occurred  approximately  60  sec 
after  ignition  of  an  exterior  fuel  fire  next  to  the  fuselage  [17].  However,  the  fiberglass  insulation 
and  honeycomb  composite  sidewall  panels  acted  as  a  fire  barrier  behind  the  skin  after  the  skin 
melted  away.  Smoke  obscuration  inside  the  cabin  occurred  much  earlier  than  significant  flame 
penetration.  (It  should  be  noted  that  the  test  conditions  assured  that  the  insulation  and  panels 
remained  intact.  Any  break  in  their  structural  integrity  would  alter  these  results.)  The 
researchers  also  found  that  early  threats  to  passengers  when  fire  enters  the  fuselage  through 
openings  were  (1)  elevated  temperatures  and  (2)  reduced  visibility  from  smoke,  before  burning 
interior  materials  became  a  factor.  As  determined  in  earlier  tests,  factors  that  greatly  affected 
flame  entry  were  wind  conditions,  door  opening  configuration,  and  fuselage  orientation. 

The  contribution  of  the  interior  materials  to  the  fire  environment  was  determined  by  subjecting 
an  intact  fuselage  to  an  external  fuel  fire  adjacent  to  an  opening  in  the  fuselage.  Wind  conditions 
were  quiescent  so  the  survivability  was  controlled  by  the  interior  materials  and  not  burning  fuel. 
Survivability  was  dominated  by  cabin  flashover,  which  occurred  at  about  210  seconds  after 
ignition.  Prior  to  flashover,  seat-top  temperature  was  near  ambient.  However,  the  researchers 
reported  that  visibility  was  reduced  by  smoke  before  any  apparent  impairment  to  the  occupants 
from  elevated  temperature  or  toxic  gases. 

The  above  test  results  were  corroborated  during  a  test  conducted  by  the  FAA  in  1996  to 
determine  the  bum  through  characteristics  of  a  transport  airplane  exposed  to  a  large  pool  fire 
upwind  of  the  fuselage  [18].  The  design  mode  for  the  test  was  the  B-737  ground  accident  in 
August  1985  in  Manchester,  England,  which  resulted  in  55  fire  fatalities.  A  Convair  880  was 
modified  so  it  was  similar  inside  to  the  B-737  in  configuration  and  interior  materials.  The  test 
had  key  elements  of  the  Manchester  accident,  including  fire  size  and  location,  relative  wind 
direction  and  velocity,  and  automatically  sequenced  door  and  escape  hatch  openings. 
Measurements  were  taken  throughout  the  cabin  of  temperature,  smoke  density,  and  O2,  CO,  and 
CO2  concentrations.  The  test  configuration  is  shown  in  figure  2-4. 
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FIGURE  2-4.  TEST  CONFIGURATION  AND  SENSOR  LOCATIONS  (BY  STATION 

NUMBER)  FOR  FAA  BURN  TEST 

After  ignition  of  the  pooled  fuel,  a  large  amount  of  flame  blew  over  the  rear  part  of  the  fuselage. 
The  fire  burned  through  the  fuselage  into  the  cabin  71  seconds  after  ignition,  igniting  a  seat  75 
sec  after  that  (146  sec  after  ignition).  Fire  also  penetrated  the  empennage  crawl  through  70  sec 
after  ignition.  The  mode  of  fire  penetration  was  direct  melting  of  the  skin  and  burning  of 
insulation  and  interior  panels.  The  interior  materials,  once  ignited,  easily  supported  a  self- 
sustaining  fire.  Thick  black  smoke  filled  the  rear  of  the  cabin  within  two  minutes.  As  the  fire 
intensity  increased,  the  smoke  moved  forward,  appearing  in  the  first  class  cabin  in  slightly  less 
than  3  minutes.  Temperatures  depended  on  the  distance  from  the  area  of  bum  through  and 
resultant  interior  fire.  A  series  of  three  flash  fires  occurred  in  the  main  cabin,  the  first  one  235 
sec  after  ignition,  causing  a  rapid  temperature  rise  and  decrease  in  oxygen.  Passengers  in  this 
part  of  the  cabin  would  have  been  subjected  to  nonsurvivable  conditions  at  this  time. 

Although  the  incorporation  of  greatly  improved  fire-resistant  interior  materials  affords  increased 
safety  and  lengthened  escape  times  during  some  fire  scenarios,  the  benefits  are  not  universal. 
Fuel  flammability  can  be  the  overriding  hazard  in  the  case  of  large  quantities  of  fuel  spillage 
and/or  when  openings  in  the  fuselage  allow  flames  and  hot  gases  and  smoke  from  the  fuel  fire  to 
enter  the  fuselage  [19].  In  this  case,  the  upper  layer  of  the  cabin  can  quickly  become 
contaminated  with  degradation  products  from  the  fuel  fire,  leading  to  flashover.  The  heat  and 
fire  spread  characteristics  of  a  fuel  fire  can  also  cause  materials  with  outstanding  fire  resistance 
to  bum  readily.  For  these  reasons,  the  National  Safety  Council  concluded  that  the  reduction  of 
the  fire  hazard  of  fuel  is  critical  in  improving  survivability  in  postcrash  fires. 
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2.3  DEVELOPMENT  OF  THE  CRASH-RESISTANT  FUEL  SYSTEM  (CRFS). 


2.3.1  Early  Developments. 

Following  the  disappointing  results  of  the  FAA’s  wing  fuel  tank  tests  conducted  in  the  late 
1940s,  the  researchers  recommended  that  any  type  of  tank  was  safer  if  it  was  protected  by 
heavier  structure  (e.g.,  the  front  spar)  and  located  away  from  areas  of  structure  prone  to 
pronounced  displacement  during  a  crash  (e.g.,  wing  roots  and  landing  gear)  [8].  They  also 
proposed  the  development  of  high-strength  and  energy-absorbing  properties  in  flexible  bladders 
as  offering  the  most  promising  solution.  They  recommended  the  use  of  flexible  fuel  lines  and 
breakaway  self-sealing  couplings  at  the  firewall  to  prevent  fuel  line  failure  and  the  use  of  inertia- 
operated  shut-off  valves  at  the  fuel  tank  outlets. 

The  FAA  then  embarked  on  a  10-year  program,  from  1950  to  1960,  to  develop  improved  crash- 
resistant  fuel  tanks  and  self-sealing  breakaway  valves  for  use  in  aircraft  fuel  systems.  Accident 
reports  and  accident  investigation  data  were  studied  to  determine  impact  attitudes  and  load 
factors  in  severe  but  survivable  accidents  for  both  fixed-  and  rotary-wing  aircraft.  Based  on  this 
data  and  the  data  obtained  during  the  previous  wing  tank  tests,  a  resultant  load  factor  of  35  G’s 
was  recommended  for  fuel  tank  design  in  fixed-wing  aircraft  since  this  load  factor  was 
considered  likely  under  severe  but  survivable  crash  conditions  [11].  It  was  also  proposed  that 
crash-resistant  fuel  cells  be  equipped  with  accessories  and  components  which  would  not  tear  the 
cell  and  which  could  seal  the  fuel  inside  the  cell  in  the  event  of  appreciable  cell  movement. 

Six  helicopter  drop  tests  were  conducted  in  the  late  1950s  to  furnish  additional  data  for  rotary 
wing  aircraft  [11].  The  helicopters  were  dropped  from  a  height  of  26  feet,  resulting  in  an  impact 
velocity  of  41  ft/sec.  Accelerometers  measured  structural  and  dummy  loads.  The  tests  resulted 
in  an  average  structural  load  factor  of  32  G’s.  The  instrumented  dummies  indicated  the  impacts 
were  survivable,  though  injuries  could  be  expected.  Thus,  the  investigators  concluded  that  a  load 
factor  of  35  G’s  was  also  justified  for  helicopter  fuel  systems. 

Three  of  the  drop  tests  were  of  helicopters  with  the  fuel  tank  located  in  the  bottom  of  the 
structure  underneath  the  two  rear  seats.  The  conventional  bladder  fuel  cell  ruptured  on  impact 
and  the  fluid  in  the  cell  flooded  the  cabin  interior.  The  two  additional  drop  tests  used  self-sealing 
fuel  cells  made  from  material  possessing  a  higher  tensile  strength.  These  cells  did  not  rupture. 
The  FAA  investigators  concluded  that,  though  previously  thought  to  be  impossible  or  at  least 
impractical,  it  was  feasible  to  design  “squash-resistant”  fuel  tanks  for  helicopters. 

Meanwhile,  in  the  mid-1950s,  5  different  fuel  cell  materials,  developed  in  a  cooperative  effort 
with  the  rubber  manufacturers,  were  being  tested  [20].  These  materials  were  a  composite, 
nonmetallic  flexible  construction  made  from  elastomer-impregnated  fabric  arranged  in  layers  or 
plies.  Two  types  of  tests  were  conducted:  (1)  strength  and  energy-absorbing  properties  of 
material  samples  were  determined  using  a  compressed-air  gun  and  (2)  impact  tests  were 
conducted  of  completed  fuel  cells  mounted  in  two  different  simulated  wing  structures.  The 
researchers  found  that  the  impact  resistance  varied  linearly  with  the  tensile  strength  and  energy¬ 
absorbing  properties  of  the  material  and  was  affected  greatly  by  the  fuel  cell  construction  (e.g., 
diffusion  barrier  liners  in  the  cell  and  reinforcement  at  vulnerable  locations  of  the  cell). 
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A  method  for  calculating  the  tensile  strength  of  crash-resistant  bladder  cell  materials  was 
developed  based  on  the  wing  impact  tests.  It  was  felt  that  the  tanks  should  not  rupture  under 
loads  sufficient  to  tear  the  wings  from  the  fuselage.  The  tensile  strength  required  was  to  be 
determined  by  using  a  compressed-air  gun  [21].  This  entire  effort  ultimately  resulted  in  the 
issuance  of  specification  MIL-T-27422A  for  fuel  tanks  in  1961.  [Subsequent  full-scale  testing 
showed  that  tensile  strength  was  not  the  main  factor  in  determining  the  crash  resistance  of  fuel 
cells  and  MIL-T-27422 A  was  subsequently  revised .] 

As  the  bladder  cell  program  was  nearing  completion,  the  FAA  began  a  program  to  develop 
crashworthy  safety  valves  and  accessories  for  the  new  tanks.  This  program  arose  from  the 
recognition  that  the  ability  of  the  fuel  cell  to  remain  intact  as  it  moved  during  a  crash  was 
influenced  by  the  accessories  attached  to  it.  Therefore,  crash-actuated  shutoff  valves  were 
needed  at  all  cell  openings  and  breakaway  attachments  to  aircraft  structure  were  needed  for  all 
fuel  cell  components  and  fuel  cell  hangers.  Guidance  for  development  of  shutoff  valves  and 
breakaway  accessories  was  obtained  from  fuel  cell  fitting  manufacturers,  aircraft  manufacturers, 
and  fuel  cell  manufacturers  at  a  conference  sponsored  by  the  FAA’s  William  J.  Hughes 
Technical  Center.  The  Center  then  designed,  fabricated,  and  tested  shutoff  valves  and  frangible 
attachments  to  be  used  with  the  new  crash-resistant  fuel  cells  [22].  The  results  of  91  dynamic 
tests  provided  enough  design  and  performance  data  to  derive  specification  requirements  for 
prototype  valves  and  accessories. 

In  1958,  contracts  were  awarded  to  aircraft  valve  manufacturers  for  prototype  breakaway  valves 
and  accessories.  Valve  assemblies  were  received  the  following  February  and  tested.  As  a  result 
of  this  program,  the  U.S.  Air  Force  prepared  a  specification  for  self-sealing  breakaway  valves 
(MIL-V-27373),  which  was  issued  in  1960. 

The  efforts  of  this  early  development  program  led  to  the  issuance  of  criteria  for  the  design  and 
installation  of  crash-resistant  fuselage  fuel  tanks  in  1958  [23].  Formulas  were  given  for 
calculating  tensile  strength  of  material  necessary  for  particular  tank  configurations.  Although 
later  testing  would  show  that  tensile  strength  alone  was  insufficient  for  crash-resistant  fuel  cell 
materials,  other  criteria  presented  are  still  the  basis  for  much  of  today’s  CRFS  design.  These  are: 

a.  Fuel  tanks  should  be  located  so  that  they  are 

•  not  likely  to  undergo  scraping  action  with  the  ground 

•  not  in  front  of  the  forward  plane  of  the  front  wing  spar 

•  not  under  or  directly  in  front  of  heavy  masses 

•  as  far  as  possible  from  occupants  and  engines 

b.  Landing  gear  structure  should  not  be  attached  to  fuel  cell  supporting  structure. 

c.  Fuel  cell  supporting  structure  and  components  in  the  immediate  vicinity  of  the  tank 
should  be  designed  or  arranged  to  minimize  the  possibility  of  puncturing  or  tearing  the 
cell. 

d.  Flexible  fuel  and  vent  lines  should  be  used  to  provide  as  much  movement  as  possible 
during  crash  conditions. 
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In  addition,  although  much  design  and  testing  would  still  have  to  be  done,  the  following  criteria 
were  included: 

a.  Shutoff  valves  should  be  located  in  the  fuel  cell  fuel  and  vent  line  outlets,  which  would 
automatically  close  in  the  event  of  any  appreciable  relative  movement  of  the  cell  with 
respect  to  another  cell  or  surrounding  structure. 

b.  Attachments  holding  the  cell  to  surrounding  structure  should  be  designed  so  the  cell  can 
pull  loose  from  the  structure  without  tearing  the  cell  wall. 

2.3.2  Helicopter  CRFS  Development. 

The  first  extensive  testing  of  the  new  crash-resistant  fuel  tanks  occurred  as  a  part  of  the  U.S. 
Army-funded  research  conducted  at  AvSER.  Several  fuel  tank  manufacturers  had  already 
qualified  fuel  cells  to  MIL-T-27422A.  Several  of  these  cells  were  installed  in  two  CH-21 
helicopters,  which  were  crash  tested  in  October  1963  [24].  The  first  test  helicopter  was  flown 
and  crashed  by  a  radio  link  remote  control  system.  Impact  velocities  were  38.5  ft/sec 
longitudinal  and  1 1  ft/sec  vertical.  The  second  helicopter  was  dropped  from  a  mobile  crane, 
impacting  with  a  longitudinal  velocity  of  38.6  ft/sec  and  a  vertical  velocity  of  36.8  ft/sec.  The 
tanks  were  punctured  in  the  low-limit  crash  and  failed  catastrophically  in  the  more  severe  crash. 
These  tests  clearly  showed  that  the  current  crash-resistant  tanks  were  not  adequate.  The  vertical 
loading  of  the  under-floor  tanks  had  been  underestimated.  Also,  puncture  and  tearing  of  the  tank 
material  from  jagged  metal  and  the  pulling  out  of  fuel  tank  fittings  had  not  been  addressed  in 
MIL-T-27422A.  It  was  apparent  that  resistance  to  puncture  and  tear  propagation  were  equally  as 
important  as  the  material’s  tensile  strength. 

A  cooperative  effort  was  undertaken  with  several  fuel  cell  manufacturers  to  develop  and  test 
improved  tank  materials  [24  and  25].  A  large  number  of  materials  were  screened  and  the  most 
promising  were  tested  for  penetration  and  tear  resistance  using  a  chisel  dropped  onto  a  material 
sample  and  a  pull  test  of  material  having  a  slit  in  it,  respectively.  Full-scale  tanks  for  crash 
testing  were  then  constructed  from  the  most  promising  of  these  materials.  These  tanks,  as  well 
as  typical  aluminum  tanks,  standard  aircraft  tanks  and  MIL-T-27422A  tanks  were  tested  in  three 
fixed-wing  and  three  helicopter  crash  tests  conducted  in  1964  and  1965.  The  fixed-wing  (C-45) 
aircraft,  containing  two  fuel  tanks  in  each  wing,  were  accelerated  along  a  monorail  into  a  35- 
degree  barrier  on  the  left  and  embedded  poles  on  the  right  so  that  both  wings  suffered  extensive 
damage.  The  helicopters  (CH-34  and  CH-21)  were  dropped  from  a  mobile  crane.  The  helicopter 
fuel  tanks  were  located  under  the  floor  with  rocks  mounted  beneath  the  fuselage  or  heavy  cargo 
above  the  tanks.  All  were  severe  but  survivable  crashes. 

The  test  results  are  shown  in  table  2-1.  All  of  the  tanks  tested  exhibited  massive  failures  except 
for  those  made  by  Goodyear  (“tough  wall”  and  “fuzzy  wall”),  which  showed  good  impact 
resistance.  The  “tough  wall”  material  consisted  of  three  to  four  plies  of  nylon  cloth  oriented  at 
various  angles  and  bonded  together  with  a  resin.  The  “fuzzy  wall”  tanks  were  made  from  a  3/8- 
inch-thick  nylon  felt  pad  with  a  variety  of  inner  membrane  sealing  films  or  layers.  The 
investigators  concluded  that  fuel  tanks  constructed  of  materials  such  as  those  made  by  Goodyear 
could  provide  excellent  crash  resistance  at  a  reasonable  weight.  They  also  concluded  that  MIL- 
T-27422A  was  inadequate  and  should  be  revised  to  include  provisions  and  tests  for  impact, 
penetration,  tear  resistance,  and  fitting  retention. 
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TABLE  2-1 .  SUMMARY  OF  AvSER  TEST  RESULTS— FULL-SCALE  CRASH  TESTS 
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Development  of  new  fuel  tank  materials  continued.  Goodyear  soon  developed  two  new 
materials  known  as  ARM-018  and  ARM-021  [24].  Both  were  laminates  using  woven  ballistic 
nylon  cloth  impregnated  with  a  urethane  elastomer.  The  typical  crash-resistant  cell  then  in  use 
had  a  tear  strength  only  9  percent  that  of  ARM-021 . 

In  1966,  Goodyear  Aerospace,  The  Aeroquip  Corporation,  E.  B.  Wiggins  Corporation,  and 
AvSER,  working  together,  began  a  comprehensive  program  to  improve  the  crash  resistance  of 
U.S.  Army  helicopters  and  to  extend  the  crash  resistance  of  the  new,  improved  fuel  cells  to  the 
entire  fuel  system.  The  fuel  systems  of  four  current  U.S.  Army  helicopters  (UH-1B,  UH-1D, 
CH-47,  OH-6A)  were  analyzed  and  evaluated  using  design  drawings,  inspections  of  as-built 
aircraft,  and  available  accident  records  [26].  Components  analyzed  included  fuel  cells  (location, 
shape,  and  installation),  fuel  cell  components,  and  their  attachments  (drains,  vents,  filler  necks, 
boost  pumps,  etc.)  and  the  fuel  transfer  system  (fuel  cell  interconnects,  fuel  lines,  fuel  line 
fittings,  etc.).  The  electrical  systems  and  other  potential  ignition  sources  also  were  evaluated. 
Recommendations  were  made  for  improving  the  crash  resistance  of  all  four  helicopter  fuel 
systems.  These  recommendations  included,  among  others,  the  use  of  the  new  crash-resistant  fuel 
tanks,  frangible  attachments  for  all  fuel  tank  components  which  had  to  be  attached  to  the  aircraft 
structure,  flexible  fuel  lines  and  stronger  fuel  line  fittings,  and  self-sealing  breakaway  valves  at 
all  tank  outlets  and  at  high-risk  locations  in  the  fuel  lines. 

In  addition  to  the  fuel  system  analyses,  a  comprehensive  testing  program  was  conducted  on 
currently  available  aircraft  fuel  lines  and  fittings.  Static  tension  and  shear  tests  were  conducted 
on  both  aluminum  tubing  and  flexible,  steel-braid-covered  hose.  All  common  sizes  of  AN  fuel 
line  fittings  (straight  and  elbow)  were  tested  in  conjunction  with  the  hoses  and  tubing.  It  was 
found  that  the  aluminum  tubing  and  the  smaller  aluminum  fittings  were  unsatisfactory  for  crash- 
resistant  systems.  Although  the  fittings  failed  before  the  hose  failed  or  pulled  out,  the  aluminum 
tubing  failed  or  pulled  out  before  the  fitting  failed.  It  was  also  determined  that  the  hose 
assemblies  had  elongations  three  to  four  times  that  of  the  tubing  assemblies. 

Meanwhile,  prototype  frangible  attachments  for  fuel  cell  components  were  fabricated  and 
subjected  to  extensive  testing  [26].  Results  showed  that  plastic  inserts  in  the  metal  attachment 
fittings  could  be  readily  developed  for  any  application. 

Since  no  self-sealing  breakaway  valves  were  commercially  available,  currently  used  quick- 
disconnect  valves  were  modified  for  use  in  tank  outlets  and  in-line  applications.  These  valves 
underwent  an  extensive  series  of  dynamic  tests  and  performed  well  under  a  wide  range  of 
conditions.  This  effort  showed  that  a  high  degree  of  protection  was  possible  with  this  type  of 
valve  and  that  the  development  of  specifically  designed  self-sealing  valves  was  quite  feasible. 
The  investigators  also  determined  that  MIL-V-27393A  for  self-sealing  breakaway  valves  was 
inappropriate  because  it  was  too  specific  and  restrictive  in  design.  This  specification  has  since 
been  canceled  and  replaced  by  SAE  ARP  161 6A. 

The  first  crash  test  of  a  complete  crash-resistant  fuel  system  was  conducted  by  AvSER  early  in 
1968  [27].  A  UH-1A  helicopter  was  equipped  with  crash-resistant  fuel,  oil  and  electrical 
systems.  The  system  included  (1)  special  crash-resistant  fuel  tanks  and  a  felt-covered  oil  tank, 
(2)  flexible  fuel  and  oil  lines  in  areas  where  rigid  metal  lines  characteristically  failed,  and 
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(3)  self-sealing  breakaway  valves  and  fuel  and  oil  line  disconnects  at  strategic  locations  to  allow 
for  relative  displacement  of  aircraft  components.  A  diagram  of  the  crash-resistant  fuel  system  is 
shown  in  figure  2-5.  The  self-sealing  breakaway  valves  in  the  fuel  lines  were  modified  quick- 
disconnect  valves.  The  breakaway  valves  installed  in  the  tanks  at  the  aft  crossover  tube  outlets 
were  prototype  valves  made  to  safely  separate  by  actually  fracturing  portions  of  the  valve  when 
crash  forces  were  great  enough,  allowing  each  side  of  the  valve  to  close.  These  “one  shot” 
valves  were  made  by  the  two  valve  manufacturers  to  meet  AvSER  specifications.  All  of  the 
individual  crash-resistant  fuel  system  components  had  been  extensively  tested  beforehand  using 
both  static  and  dynamic  tests. 


FIGURE  2-5.  UH-1A  CRASH-RESISTANT  FUEL  SYSTEM 


2-16 


The  helicopter  was  remotely  flown  to  impact  with  a  longitudinal  velocity  of  81  ft/sec  and  a 
vertical  velocity  of  23  ft/sec.  The  impact  angle  was  15.5  degrees.  All  of  the  systems  functioned 
satisfactorily  and  there  was  no  fuel  or  oil  spillage.  However,  the  vertical  loading  during  impact 
was  insufficient  to  activate  all  of  the  fuel  system  crash-resistant  components.  A  follow-on  test 
was  conducted  by  dropping  the  fuselage  section  containing  the  fuel  system  onto  several  vertical 
railroad  ties.  The  tie  beneath  the  left  cell  impacted  the  boost  pump,  driving  it  up  into  the  fuel  cell 
and  pulling  the  mounting  out  of  the  cell  by  shearing  the  tank  wall  at  the  bolt  holes.  The  right  cell 
was  also  severely  impacted  on  the  bottom  but  did  not  rupture.  The  self-sealing  quick- 
disconnects  used  in  the  forward  and  aft  crossover  tube  connections  functioned  properly, 
disconnecting  and  sealing  the  tank  outlets.  The  fact  that  the  conventionally  mounted  pump 
fitting  sheared  the  tank  wall  at  the  bolt  holes  clearly  indicated  that  new,  100-percent  retention 
designs  must  be  used. 

2.3.3  Implementation  of  CRTS  in  Helicopters. 

The  implementation  of  CRFS  technology  in  the  military  proceeded  along  two  complementary 
paths.  One  path  was  the  preparation  of  design  guides  and  specifications  incorporating  the  new 
technology  and  the  other  was  the  actual  design  and  installation  of  CRFSs  in  U.S.  Army 
helicopters. 

In  1965  the  U.S.  Army  initiated,  under  its  contract  with  AvSER,  a  project  to  consolidate  the 
knowledge  and  design  criteria  published  in  the  previous  AvSER  reports  into  one  report.  This 
report  was  to  summarize  the  state-of-the-art  in  crashworthy  technology  and  include  pertinent 
work  conducted  by  other  agencies  as  well  as  that  done  by  AvSER.  This  report  was  published  in 
1967  as  the  Crash  Survival  Design  Guide  [28],  The  Design  Guide,  as  it  came  to  be  known, 
included  all  aspects  of  crashworthiness  (aircraft  crash  survival  impact  conditions  and  design 
pulses,  airframe  crashworthiness,  seat  and  restraint  harness  design  criteria,  occupant  environment 
criteria,  emergency  escape  provisions  and  postcrash  fire  safety).  The  section  on  postcrash  fire 
safety  was  mostly  devoted  to  the  design  of  CRFS.  Some  design  criteria  were  presented  for 
ignition  source  control,  such  as  de-energizing  electrical  sources,  inerting  hot  surfaces,  and 
shielding  wires  and  electrical  components.  A  brief  discussion  of  the  postcrash  fire  environment 
as  related  to  human  tolerance  and  escape  times  also  was  presented. 

The  criteria  for  CRFS  included  a  detailed  analysis  of  MIL-T-27422A  and  showed  why  the 
cut-  and  tear-resistance  of  the  fuel  tank  material  was  vital  to  its  survival  during  a  crash. 
Properties  of  the  new  materials  were  presented  along  with  those  of  then  standard  materials,  as 
shown  in  figure  2-6.  The  areas  under  the  curves  in  figure  2-6  denote  the  energies  necessary  to 
fail  these  materials.  The  new  materials  absorbed  eight  to  twelve  times  more  energy  than  the 
MIL-T-27422A  material. 

The  Design  Guide  also  stressed  the  interaction  of  the  fuel  system  components  and  aircraft 
structure  during  the  crash.  Since  failure  of  the  tank  was  often  caused  by  the  tearing  of  the  tank 
wall  around  the  attachments  as  the  tank  moved  in  relation  to  the  surrounding  structure,  the  use  of 
frangible  attachments  and  self-sealing  breakaway  valves  was  specified.  Protected  locations  for 
fuel  lines,  extra  length  in  the  lines,  and  the  use  of  flexible  hose  with  a  braided  steel  covering 
were  recommended. 
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FIGURE  2-6.  RESISTANCE  TO  TEAR  FOR  TANK  MATERIALS 


The  Design  Guide  was  updated  to  include  research  completed  by  AvSER  (now  a  division  of 
Dynamic  Science)  and  Goodyear  through  January  1969  [29].  Major  additions  to  the  CRFS 
design  criteria  included  examples  of  high-strength  fuel  tank  metal  insert  retention  methods  and 
the  requirement  that  the  inserts  have  a  retention  strength  of  at  least  80  percent  of  the  tank  wall 
strength.  Drawings  showing  different  applications  of  self-sealing  valves  also  were  included 
along  with  the  requirement  that  such  valves,  as  well  as  all  frangible  attachments,  should  separate 
at  less  than  50  percent  of  the  load  required  to  fail  the  attached  component.  In  addition,  the  vent 
system  design  was  expanded  to  prevent  vent-line  failure  or  spillage  from  a  rollover.  Minimum 
loads  for  fuel  line  fittings  were  also  specified. 

Additional  research  and  testing  of  fuel  tanks  resulted  in  the  formulation  and  publication  of  MIL¬ 
T-2742213  in  February  1970  [30],  The  specification  was  completely  revised  and  included  new 
requirements  to  ensure  the  fuel  tanks  would,  indeed,  be  crash  resistant.  In  addition  to  laboratory 
tests  of  the  fuel  tank  material  to  measure  the  puncture  and  tear  resistance,  tests  were  also 
required  to  assure  satisfactory  tank  fitting  retention  strength.  Perhaps  the  most  important  change 
was  the  inclusion  of  dynamic  testing  of  the  completely  configured  fuel  tank  by  dropping  it,  filled 
with  water,  onto  a  flat  surface  from  a  height  of  65  feet. 

The  research,  design,  and  testing  involved  for  the  development  of  the  UH-1D/H  helicopter  CRFS 
(begun  in  1968)  yielded  much  more  knowledge  about  design  criteria  for  CRFS  and  their 
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components.  Accordingly,  the  Design  Guide  was  revised  again  in  1971  [31].  Extensive 
additions  were  added  in  all  areas,  including  that  section  devoted  to  CRFS  design.  Requirements 
from  MIL-T-27422B  were  added,  including  the  65-foot  drop  test  of  the  fuel  tank  with  no 
leakage.  Test  methodology  was  included  to  assure  tank  fitting  retention  strength  of  80  percent  of 
tank  wall  strength.  Requirements  for  the  separation  loads  of  frangible  attachments  and  self¬ 
sealing  breakaway  valves  specified  that  the  attachments  and  valves  must  meet  all  operational 
requirements  but  should  separate  at  25  to  50  percent  of  the  load  required  to  fail  the  attached 
system  or  component.  Methods  of  analyzing  and  calculating  the  force  in  the  most  likely 
direction  of  occurrence  during  impact  were  presented.  Criteria  for  the  self-sealing  valves  stated 
that  the  valves  should  be  specifically  designed  for  a  “one  shot”  emergency  breakaway  function. 
Additionally,  minimum  loads  were  required  for  fuel  lines  and  their  fittings  and  test  methods  were 
specified.  This  edition  of  the  Design  Guide  was  the  basis  for  the  criteria  contained  in  MIL-STD- 
1290  released  in  January  1974  [32],  The  Design  Guide  has  since  been  revised  and  expanded 
twice  as  more  knowledge  has  become  available  in  all  areas  of  crashworthiness.  The  latest 
revision  was  published  in  1989. 

In  1968,  the  U.S.  Army  committed  itself  to  markedly  reducing  postcrash  fires  in  survivable 
helicopter  accidents.  Dynamic  Science  thus  began  a  program  for  the  U.S.  Army  to  integrate  a 
CRFS  into  the  UH-1D/H  helicopter  manufactured  by  Bell  Helicopter  Company  [33  and  34].  The 
effort  began  by  studying  UH-1D  and  related  accident  cases  to  determine  problem  areas.  The  fuel 
system  also  was  evaluated  by  the  previously  developed  rating  system  (which  had  been  expanded 
to  include  a  more  detailed  process)  to  determine  the  overall  fire  hazard  attributable  to  specific 
fuel  system  components.  Crashed  but  intact  hulls  provided  data  for  dimensions,  possible 
interferences,  and  general  system  layout.  As  work  progressed,  a  close  liaison  was  maintained 
with  the  Bell  Helicopter  engineers  and  component  suppliers.  The  design  used  many  off-the-shelf 
items,  but  some  items  (which  were  only  laboratory  specimens  at  the  beginning)  had  to  be 
designed  and  built  by  various  suppliers,  then  tested  for  operational  and  crashworthy 
acceptability.  Almost  700  static  and  dynamic  tests  were  conducted  to  assess  the  crash 
effectiveness  of  the  various  components  in  the  fuel  system. 

The  UH-1D/H  CRFS  is  illustrated  in  figure  2-7.  The  CRFS  consisted  of  five  interconnected 
MIL-T-27422B  fuel  tanks  and  tank  outlets;  self-sealing  breakaway  valves  at  the  most  vulnerable 
tank  outlets;  flexible  steel-braid-covered  hose  with  in-line  breakaway  valves  at  probable  failure 
points;  and  frangible  connectors  at  tank-to-structure  interfaces  (tank  components  and  hangers). 
Three  full-scale  crash  tests  were  conducted  with  helicopters  containing  the  CRFS:  one  vertical 
drop  test  and  two  tests  by  guiding  the  helicopter  down  an  inclined  cable,  all  onto  irregular  terrain 
consisting  of  several  large  rocks  and  a  stump.  The  fuel  system  generally  performed  as  designed 
with  only  a  few  components  allowing  some  leakage.  The  fuel  tanks  did  not  fail  at  all.  The 
UH-1D/H  CRFS  was  judged  to  be  highly  resistant  to  failure  in  survivable  accidents. 

In  April  1970,  with  the  component  leakage  problem  resolved,  the  first  UH-1H  helicopter  with  a 
CRFS  came  off  the  production  line  and  all  subsequent  production  helicopters  were  equipped 
with  the  CRFS.  The  manufacturers  of  the  other  military  helicopters,  i.e.,  Boeing,  Sikorsky, 
Hughes,  and  Bell,  started  designing  crash-resistant  fuel  systems  for  their  helicopters  using 
consulting  input  from  the  AvSER  group  of  Dynamic  Science  and  past  AvSER  employees  who 
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had  joined  the  Robertson  Research  Group  at  Arizona  State  University.  An  extensive  retrofit 
program  was  also  begun  to  equip  already  manufactured  helicopters  with  a  CRFS. 


FIGURE  2-7.  UH-1D/H  CRASH-RESISTANT  FUEL  SYSTEM 

A  study  conducted  by  the  U.S.  Army  of  helicopter  accidents  from  1970  through  mid-1973 
showed  that  the  CRFS  performed  remarkably  well  [35],  There  were  no  thermal  injuries  or 
fatalities  in  any  of  those  helicopters  equipped  with  a  CRFS.  A  later  study  of  U.S.  Army 
helicopter  accidents  from  1970  through  1976  corroborated  the  outstanding  performance  of  the 
CRFS  [36],  Data  from  this  study  showed  that  the  CRFS  had  reduced  thermal  injuries  by  75 

percent  and  had  eliminated  thermal  fatalities.  The  investigators  concluded  that  the  CRFS  “ . 

has  been  shown  to  be  a  highly  successful  and  operationally  effective  mechanism.” 

In  1975,  researchers  who  had  been  instrumental  in  developing  the  CRFS  for  military  helicopters 
concluded  that  it  would  be  a  logical  step  to  provide  postcrash  fire  protection  to  the  civilian 
aviation  industry  and  that  no  new  scientific  breakthroughs  would  be  necessary  to  do  this  [37], 
Shortly  thereafter,  at  least  one  manufacturer  was  planning  to  incorporate  some  CRFS  technology 
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into  one  of  its  civil  helicopters  [38].  This  twin-engine,  eight-passenger  helicopter  was  first  flight 
tested  in  1976  and  scheduled  for  delivery  in  1979  (actual  delivery  started  early  in  1980).  The 
helicopter  contained  four  crash-resistant  fuel  cells — two  in  the  sponson  structures  and  two  in  the 
fuselage  just  aft  of  the  passenger  compartment.  The  attaching  sponson  fuel  and  vent  lines 
incorporated  self-sealing  breakaway  fittings  at  the  junctures  of  the  sponsons  and  fuselage.  (The 
fuel  cells,  though  not  as  crash  resistant  as  MIL-T-27422B  fuel  cells,  had  passed  a  50-foot  drop 
test  and  were  a  marked  improvement  over  the  regular  bladder  cells.) 

By  1986,  the  Aerospace  Industries  Association  of  America  (AIAA)  had  established  a  Helicopter 
Crashworthiness  Project  Group  to  determine  if  crash  safety  improvements  were  needed  for  future 
civil  helicopters.  This  group  concluded  that  “Energy  attenuating  seats  with  shoulder  harnesses 
and  a  crash-resistant  fuel  system  are  significant  crash  safety  improvements  that  can  be  made  for 
future  civil  helicopters  ....”  [39].  They  also  called  for  lower  crash-resistant  requirements  for  the 
fuel  system  since  they  believed  the  civil  survivable  crash  environment  was  not  as  severe  as  the 
military’s.  They  recommended  that  the  test  methods  of  MIL-T-27422B  be  used  but  with  lower 
criteria,  i.e.,  a  drop  height  of  50  feet  (56  ft/sec)  with  the  fuel  tank  only  80  percent  full  of  water. 
They  also  determined  that  the  CRFS  should  tolerate  displacement  between  components  due  to 
structural  deformation  during  a  crash  and  that  stretchable  hoses,  extra  length  hoses,  self-sealing 
breakaway  valves  and  frangible  fuel  cell  attachments  might  be  needed. 

The  criteria  recommended  by  the  Committee  for  crash-resistant  fuel  tanks  in  civil  helicopters  are 
shown  inside  the  enclosed  area  of  table  2-2.  This  table  shows  the  range  of  fuel  cell  bladder 
material  in  use  at  the  time.  (Uniroyal  and  FPT  are  shown  because  their  data  was  immediately 
available,  but  other  manufacturers  also  made  fuel  cell  materials  in  the  same  range.)  Most  civil 
helicopters  flying  then  were  using  material  similar  to  the  standard  bladder  material  shown  on  the 
left  of  table  2-2,  but  the  author  reported  that  nine  models  of  civil  helicopters  did  incorporate 
some  degree  of  crash  resistance  in  their  fuel  systems  by  1986. 

Note:  The  fuel  cell  drop  tests  reported  in  table  2-2  did  not  include  the  surrounding  aircraft 
structure.  The  low  tear  resistance  and  puncture  resistance  of  some  of  the  materials  as 
compared  to  that  of  the  MIL-T-27422B  material  (shown  on  the  right  of  table  2-2)  will 
compromise  the  integrity  of  the  fuel  cell  during  a  crash  in  which  the  cell  wall  must  bridge 
a  gap  in  the  surrounding  structure  caused  by  structural  displacement  during  a  crash.  If 
the  cell  wall  comes  in  contact  with  sharp  objects  or  tom  structure  at  this  time,  it  would  be 
very  vulnerable  to  puncturing  and  tearing.  This  type  of  failure  was  discovered  early  in 
the  development  of  crash-resistant  fuel  systems  and  has  been  discussed  at  some  length. 
Certainly  the  crash  experience  of  the  military  helicopters,  both  with  and  without  crash- 
resistant  fuel  systems,  as  well  as  the  numerous  helicopter  crash  tests  conducted  over  the 
years,  substantiate  the  need  for  high  levels  of  puncture  and  tear  resistance  of  fuel  cell 
materials  in  all  helicopters. 

A  study  conducted  for  the  FAA  in  1994  found  that  ten  models  of  civil  helicopters  incorporated 
some  degree  of  crash  resistance  in  their  fuel  systems  at  that  time  [40].  The  primary  purpose  of 
the  study  was  to  identify  levels  of  crash  resistance  that  could  be  incorporated  into  civil 
helicopters  in  different  areas,  including  the  fuel  system.  This  study  also  recommended  a  50-foot 
drop  test  for  the  fuel  cell  versus  the  65-foot  drop  required  by  the  military. 
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TABLE  2-2.  CRFS  FUEL  CELL  MATERIAL  COMPARISON  (circa  1983) 


Test/Description 

Standard 

Bladder 

US-566RL 

Safety 

Cell 

US-770 

Safety 

Cell 

US-756 

FPT** 

FPT/ 

CR.615 

Military 

MIL-T- 

27422B 

US-751 

Drop  height  with  no 
spillage  (ft) 

NA 

50 

(80% 

Full) 

50* 

(80% 

Full) 

65 

(Full) 

65 

(Full) 

Constant  rate  tear  (ft-lb) 

NA 

400 

210.0 

400 

Tensile  strength  (lb) 

BMHliWBiif 

Warp 

140 

168 

1717 

NA 

NA 

Fill 

120 

1128 

NA 

NA 

Impact  penetration 

(5  lb  Chisel) 

Drop  height  (ft)) 

Parallel/warp 

NA 

1.2 

8.5 

10.5 

15 

45°  Warp 

NA 

8.5 

15 

Screw  driver  (lb) 

25 

333-446 

370.5 

NA 

NA 

Material  weight  (lb/ft2) 

0.12 

0.36 

0.40 

0.55 

1.04 

Weight  increase  factor 

l.Ox 

3. Ox 

3.3x 

4.6x 

8.7x 

*  Also  dropped  from  65  ft  with  no  spillage 
**  350%  Elongation 


Design  configurations  proposed  for  civil  helicopter  CRFSs  included  crash-resistant  fuel  cells; 
flexible,  steel-braid-covered  hose  for  fuel  lines;  self-sealing  breakaway  valves  where  the  fuel  line 
passes  through  the  firewall  and  at  other  locations  where  necessary  (e.g.,  tank  outlets,  tank  cross¬ 
feed  lines);  frangible  attachments  for  all  tank  component-to-structure  attachments;  suction  fuel 
feed;  and  means  of  preventing  fuel  spillage  through  the  vents.  The  development  of  CRTS 
technology  had  come  far  enough  by  this  time  that  the  study  report  was  able  to  list  manufacturers 
of  crash-resistant  fuel  cells,  fuel  lines,  and  self-sealing  breakaway  valves  for  the  civil  aircraft 
industry. 

In  1990,  the  FAA  proposed  amendments  to  Title  14  CFR,  Parts  27  and  29,  to  minimize  postcrash 
fire  in  survivable  helicopter  impacts  by  specifying  new  requirements  for  fuel  system  crash 
resistance  in  civil  rotorcraft.  The  Final  Rule,  effective  in  1994  for  newly  certificated  aircraft, 
adds  Sections  27.952  and  29.952,  respectively,  titled  Fuel  System  Crash  Resistance.  These 
sections  require  50-foot  drop  tests  for  each  fuel  tank;  minimum  inertial  load  factors  for  tank 
design  and  installation;  self-sealing  breakaway  couplings  at  tank-to-fuel  line  and  tank-to-tank 
connections  and  at  those  points  in  the  fuel  system  where  local  structural  deformation  could  lead 
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to  the  release  of  fuel;  frangible  or  deformable  attachments  between  fuel  tanks  and  fuel  system 
components  to  rotorcraft  structure;  and  separation  of  fuel  and  ignition  sources.  In  addition,  rigid 
or  semirigid  fuel  tank  or  bladder  walls  must  be  impact  and  tear  resistant.  These  amendments 
incorporated  many  of  the  successful  strategies  that  were  imposed  on  military  rotorcraft  by  MIL¬ 
T-274223  and  MIL-STD  1290 A. 

2.3.4  Airplane  CRTS  Development. 

Although  the  U.S.  Army- funded  CRFS  research  program  had  succeeded  in  the  development  and 
installation  of  CRFSs  in  military  helicopters  by  1970,  the  development  of  CRFSs  for  fixed-wing 
aircraft  did  not  proceed  as  rapidly  or  with  the  same  sense  of  urgency.  The  impact  of  the 
increased  fire  fatalities  due  to  the  Vietnam  War  undoubtedly  spurred  on  the  U.S.  Army’s 
program  while  no  such  emergency  existed  in  the  civil  sector.  In  addition,  although  the  basic 
principles  underlying  the  CRFS  are  the  same  for  all  aircraft,  designing  a  CRFS  for  fixed-wing 
aircraft  was  inherently  more  difficult  than  designing  for  the  relatively  box-like  structure  of  a 
helicopter.  Thus,  CRFS  research  and  development  efforts  for  fixed-wing  aircraft  continued. 

In  the  mid-1960s,  around  the  same  time  that  the  full-scale  C-45  crash  tests  were  run  (previously 
described  in  section  2.3.2),  a  series  of  tests  were  conducted  on  a  DC-7  wing  containing  CRFS 
components  [41].  High-strength  bladder  fuel  cells,  frangible  attachments,  self-sealing 
breakaway  valves,  and  fiberglass  protective  liners  were  installed  in  one  section  of  the  wing  in 
place  of  the  standard  bladder  cells  and  the  integral  tank.  The  standard  tanks  remained  in  the 
other  section  of  the  wing.  The  wing  was  mounted  on  a  jet-propelled  dolly  and  accelerated  into  a 
decelerator.  Eleven  controlled  deceleration  tests  ranging  from  2-21  G’s  were  conducted.  There 
were  no  failures  in  either  the  standard  or  crash-resistant  fuel  cells  and  there  were  no  inadvertent 
valve  closures  in  the  CRFS. 

A  final  destructive  test  was  conducted  where  the  wing  was  run  into  two  vertical  poles  (at  77  kts) 
positioned  to  shear  the  wing  panels  at  the  outboard  nacelles.  Both  outboard  nacelles  were 
severed  from  the  wing.  The  standard  fuel  system  integral  tank  was  split  vertically  and  the 
bottom  skin  and  center  spar  were  tom  free.  The  outboard  bladder  cell  was  ripped  and  punctured. 
All  of  the  fuel  was  lost  before  the  test  specimen  could  be  stopped.  The  CRFS  front  and  rear 
outboard  cells  were  punctured  and  the  rear  cell  was  also  ripped  by  structure  after  the  liner  was 
tom  free.  All  of  the  self-sealing  valves  functioned  satisfactorily  except  for  two  3-inch  transfer 
valves  between  ruptured  and  undamaged  cells.  It  was  concluded  that  the  breakaway  valves, 
which  were  actuated  by  cables  containing  weak  links,  needed  a  more  positive  means  of 
triggering.  However,  it  took  17  minutes  for  all  the  fuel  to  drain  from  the  CRFS  compared  to  the 
near  instantaneous  fuel  loss  from  the  original  fuel  system. 

Subsequently,  in  the  late  1960s,  the  FAA  conducted  more  DC-7  wing  section  tests  to  determine 
the  capability  of  a  CRFS  using  ARM-021  fuel  tanks  [42],  The  three  tanks  in  each  wing  were 
interconnected  with  cable-lanyard-actuated  self-sealing  breakaway  valves.  The  void  between  the 
tank  walls  and  skin  was  filled  with  Styrofoam  backing  board.  The  wing  sections  impacted  a  log 
and  steel  stanchion  held  in  place  by  two  shear  pins.  Twenty-five-mph  tests  were  conducted  with 
a  pendulum  facility  and  75-mph  tests  were  run  on  a  catapult  and  track  facility. 
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The  first  two  low-speed  tests  were  not  severe  enough  to  damage  the  cells  or  actuate  the  valves. 
A  third  test  resulted  in  the  stanchion  intruding  16  inches  into  the  middle  tank.  All  of  the  valves 
closed  but  there  was  a  slight  cut  in  the  tank  from  jagged  metal  (6-gal/hr  leakage).  The  first  75- 
mph  test  pulled  the  center  cell  from  its  frangible  fastenings  to  the  wing  structure.  The  valves 
closed  but  there  was  a  small  leak  (10  gal/hr)  from  a  piece  of  metal  piercing  the  cell.  In  the 
second  75-mph  test,  the  middle  cell  was  tom  from  the  frangible  fastenings,  activating  the  valves. 
The  wing  flipped  over  and  slid  upside  down,  resulting  in  a  broken  filler  cap  and  the  loss  of  all 
fuel  in  the  center  cell.  However,  there  was  no  loss  from  the  other  two  interconnected  cells 
because  the  self-sealing  breakaway  valves  closed.  In  any  case,  the  leakage  rates  were  much  less 
than  with  integral  tanks.  The  researchers  concluded  that  a  foolproof  method  to  prevent 
inadvertent  closing  of  the  self-sealing  breakaway  valves  was  needed  so  these  kinds  of  valves 
could  be  used  in  fixed-wing  aircraft.  They  also  believed  this  system  was  feasible  for  air  taxi 
airplanes  and  that  the  safety  advantage  outweighed  the  weight  and  volume  penalties  associated 
with  the  system. 

In  the  mid-1960s,  efforts  were  under  way  to  improve  the  crash  resistance  of  integral  fuel  tanks 
without  using  bladder  cells.  The  FAA  sponsored  a  study  to  develop  design  improvements  in 
transport  airplane  integral  tanks  to  enhance  fuel  containment  during  survivable  crashes  [43],  The 
study  determined  that  the  most  critical  loading  condition  was  concentrated  impact  along  the  front 
spar  and  lower  surface  as  the  airplane  stmck  obstacles  such  as  trees  and  poles.  The  most  likely 
loading  was  due  to  distributed  impacts,  as  in  a  wheels-up  landing.  However,  any  wing  that  could 
break  trees  could  sustain  severe  ground  contact  loads.  Reinforcements  which  would  allow 
conventional  structures  to  break  poles  consisted  of  strengthening  the  front  spar  rails  and  skin 
panels  aft  of  the  rails.  Analyses  showed  that,  if  the  reinforcing  material  were  added  primarily  to 
the  lower  rail  and  lower  surface,  fuel  containment  would  be  efficiently  improved  for  both  the 
most  critical  and  most  likely  crash  conditions. 

The  analytical  results  were  substantiated  by  an  extensive  test  program  with  full-scale  fuel  tanks. 
The  tanks  were  dropped  onto  obstacles  simulating  concentrated  impacts  and  onto  an  inclined 
mound  to  simulate  distributed  impacts.  The  results  of  the  study  indicated  that  substantial 
improvements  in  fuel  containment  could  be  designed  into  wings  similar  to  those  currently  used 
(circa  1960).  The  authors  also  stressed  the  need  for  fuel  containment  in  the  fuel  lines,  and  stated 
that  shutoff  valves  must  be  positioned  so  they  are  not  tom  off  if  the  engine  is  tom  off.  They  also 
recommended  that  the  valves  should  automatically  shut  off  if  the  engine  was  displaced.  (The 
valves  could  be  actuated  by  engine  displacement  or  use  of  a  quick-disconnect  feature.) 

Subsequent  tests  conducted  by  the  FAA  in  the  late  1960s  on  two  DC-7  outer  wing  panels,  which 
had  been  structurally  reinforced,  ended  with  mixed  results  [44],  The  outer  wing  panel  of  one  of 
the  wings  was  strengthened  chordwise  with  a  0.040-inch-thick  aluminum  doubler.  The  other 
wing  panel  had  a  0.020-inch-thick  aluminum  doubler  installed  in  a  similar  manner  and  also  had 
chordwise  aluminum  tee  sections  extending  from  the  front  of  the  spar  cap  to  slightly  aft  of  the 
second  spanwise  stringer  at  6-inch  intervals.  The  wings  were  swung  on  a  pendulum  to  impact  a 
pole  mounted  with  a  shear  pin  to  limit  loads.  Impact  velocities  of  27  mph  resulted  in  G  forces  as 
high  as  25.  The  first  modified  wing  ruptured  almost  as  much  as  an  unmodified  control  wing. 
However,  the  wing  reinforced  with  the  tee  sections  did  not  rupture. 
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The  FAA  also  conducted  a  study  in  this  same  time  period  to  evaluate  the  crash  resistance  of  a 
typical  jet  transport  wing  leading-edge  fuel  tank  [45].  The  primary  purpose  was  to  investigate  a 
drop  test  method  for  testing  wing  leading  edges.  The  wing  was  mounted  vertically  under  the 
drop  tower  and  the  impact  article  was  dropped,  in  a  horizontal  position,  onto  the  wing  leading 
edge.  The  impact  article  was  accelerated  up  to  the  desired  speed  by  a  bungee  cord.  Obstacles 
used  were  pine  logs,  angle  iron,  and  steel  poles  (pipe).  Test  results  showed  that  failure  of  the 
leading  edge  occurred  at  approximately  93  mph  with  the  log  and  74  mph  with  the  pipe.  The 
researchers  concluded  that  the  test  setup  was  an  acceptable  way  to  evaluate  the  strength  of 
leading-edge  fuel  tanks  without  fuel  in  the  tanks.  The  pipe  was  the  best  test  obstacle  because  it 
was  the  most  repeatable.  The  researchers  proposed  the  following  test  criterion:  the  wing  should 
withstand  without  cracking  or  rupture  an  impact  of  a  4-in.-diameter  pipe  with  an  impact  velocity 
equal  at  least  to  one-half  of  the  stall  speed  of  the  aircraft  at  maximum  takeoff  weight. 

Alternate  methods  also  were  being  investigated  to  improve  the  fuel  containment  capabilities  of 
integral  tanks  during  airplane  crashes.  The  FAA  conducted  tests  on  F-86  droppable  fuel  tanks 
filled  with  10  or  60  ppi  reticulated  polyurethane  foam  [44].  Some  tanks  were  dropped  onto  a 
concrete  pad  at  32.5  mph.  Other  tanks  were  catapulted  into  a  steel  plate  on  a  sloped  earthen 
embankment  at  speeds  of  80  mph  in  the  presence  of  an  open  flame.  The  drop  tests  showed  that 
the  fuel  spray  patterns  for  tanks  without  foam  and  those  with  foam  were  similar  relative  to  the 
depth  of  horizontal  and  vertical  areas  encompassed.  Thus,  the  possibility  of  spray  contacting  an 
ignition  source  would  be  the  same  for  both.  The  catapult  tests  showed  that,  in  all  configurations, 
fuel  spray  ignited  within  a  time  interval  of  40  to  60  msec.  Thus,  the  presence  of  the  foam  was 
considered  quite  insignificant  to  crash  fire  safety. 

Additional  concepts  investigated  were  the  use  of  elastomeric  liners  and  curtains  inside  the  fuel 
tank  to  maintain  the  integrity  of  the  fuel  tank  during  crashes,  with  the  secondary  purpose  of 
reducing  fuel  flow  if  integrity  was  lost.  Initial  laboratory  tests  resulted  in  two  feasible  liners  for 
integral  fuel  tanks:  (1)  a  frangible  bond/extendable  film,  which  could  drape  wounds  or 
encapsulate  penetrating  objects  and  (2)  several  inches  of  foam  bonded  to  the  inside  of  the  tank 
wall  to  reduce  flow  through  a  puncture  wound  if  integrity  was  lost  [46],  Subsequent  drop  tests  of 
these  and  other  liner  and  curtain  concepts  showed  that,  if  the  liners  or  curtains  were  thin  enough 
to  conform  to  the  damaged  tank  structure  and  seal  the  wound,  they  would  be  punctured.  If  they 
were  strong  enough  to  resist  puncture,  they  would  not  conform  to  the  structure  and  fuel  would 
flow  around  them  and  out  the  wound  [47],  The  investigators  concluded  that  no  system 
dependent  upon  the  continued  support  of  the  aircraft  structure  would  be  successful  in  eliminating 
or  controlling  postcrash  fuel  spills  and  these  concepts  were  abandoned. 

Research  and  development  efforts  for  transport  airplane  CRFS  technology  languished  during 
most  of  the  1970s  as  efforts  were  focused  instead  on  improving  the  crash  safety  of  general 
aviation  airplanes,  including  the  development  of  CRFS  fuel  systems  for  these  aircraft.  In  1973, 
NASA  and  the  FAA  began  a  10-year  joint  study  on  the  crash  dynamics  of  general  aviation 
airplanes  under  controlled,  free-flight  conditions  [48  and  49].  The  object  of  this  program  was  to 
determine  the  dynamic  response  of  airplane  structures,  seats,  and  occupants  during  a  crash  and  to 
determine  the  effect  of  flight  parameters  at  impact  on  loads  and  structural  damage.  Twenty-one 
full-scale,  instrumented  crash  tests  were  conducted  using  a  gantry  structure  and  allowing  the 
aircraft,  suspended  and  guided  by  cables,  to  swing  pendulum-style  onto  the  impact  surface  (see 
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figure  2-8).  Analysis  of  the  test  data  resulted  in  representative  floor  deceleration  pulses,  which 
could  be  used  for  postcrash  analysis  and  comparisons  to  human  tolerance  data,  as  well  as 
establishing  the  parameters  for  the  development  of  crash-resistant  structures  and  improved  seats 
and  restraints. 


MOVEABLE  BRIDGE 


FIGURE  2-8.  FULL-SCALE  CRASH  TEST  METHOD 

Concurrently  with  the  crash  tests  described  above,  the  FAA  conducted  four  full-scale  crash  tests 
of  light  twin-engined  airplanes  with  experimental  CRFSs  [50  and  51].  The  tests  were  done  to 
evaluate  the  performance  of  various  light-weight,  flexible,  crash-resistant  fuel  cells  with  self¬ 
sealing  breakaway  valves  installed  in  the  fuel  and  vent  line  outlets.  Since  the  fuel  tanks  would 
be  located  in  the  wings  ahead  of  the  main  spar,  they  had  to  be  lighter  weight  and  more  flexible 
than  the  MIL-T-27422B  tanks,  but  tear  and  puncture  resistance  were  still  primary  criteria.  Five 
types  of  tank  materials  were  used  consisting  of  one  to  three  plies  of  fabric  with  fabric  weights 
from  5.50  to  12.75  oz/sq  yd.  A  standard  bladder  tank  was  also  used  in  one  of  the  tests.  The  self¬ 
sealing  breakaway  valve  installed  in  the  fuel  line  outlet  was  activated  by  an  actuating  arm 
installed  to  impact  the  attached  fuel  line  (aluminum  tubing)  as  the  airplane  contacted  the  ground 
(see  figure  2-9). 
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RIB  (REF) 


DIRECTION  ACTUATING  ARM 


FIGURE  2-9.  SELF-SEALING  BREAKAWAY  VALVE  INSTALLATION  (WING  ROOT) 

The  tests  were  conducted  on  a  catapult  test  track.  After  the  airplane  was  accelerated  up  to  speed, 
the  landing  gear  was  knocked  off  by  an  I-beam  barrier.  The  airborne  airplane  then  struck  a  4° 
earthen  embankment  containing  embedded  steel  poles  to  impact  the  wings  (two  on  each  side). 
Impact  speeds  ranged  from  93  to  95  ft/sec. 

The  test  results  are  shown  in  table  2-3.  Both  one-ply  tanks  made  from  fabric  whose  weight  was 
less  than  12.75  oz/sq  yd  failed.  The  original  bladder  tank  failed  catastrophically.  There  was  no 
damage  to  the  remaining  tanks.  The  self-sealing  breakaway  valves  performed  satisfactorily  in  all 
of  the  tests.  The  authors  cautioned  that  these  tests  with  the  light-weight  tanks  were  not 
applicable  to  belly  or  nacelle  tanks  whose  shape  would  not  allow  the  tanks  to  increase  in  volume 
during  impact,  thus  letting  hydraulic  pressure  remain  low.  Nonetheless,  the  feasibility  of 
designing  increased  crash  resistance  into  the  fuel  systems  of  general  aviation  airplanes  was 
firmly  established. 
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TABLE  2-3.  CRASH  TEST  DATA 


Test 

No. 

Fuel 

Tank 

L.H. 

Fabric 

Weight 

(oz/sq.yd) 

Fuel 

Tank 

R.H. 

Fabric 
Weight 
(oz/sq.  yd) 

Aircraft 

Weight 

lb 

Impact 

Speed, 

ft/sec 

Maximum 

Acceleration 

(k) 

Damage 

1 

2-Ply* 

US758 

12.75 

3-Ply 

US759 

12.75 

2,660 

93 

Fwd 

Up 

None  to  either 
tank 

2 

2-Pl;y 

US758 

12.75 

Original 

Aircraft 

Bladder 

Cell 

2,660 

93 

15 

5 

None  to  either 
tank 

R.H.  tank 
ruptured 

3 

2-Ply 

US758 

12.75 

1-Ply 

US764 

12.75 

2,598 

95 

29 

7.5 

i - c _ 

None  to  either 
tank 

4 

1-Ply 

US768 

5.50 

1-Ply 

USA762 

8.00 

2,590 

95 

27 

55 

Both  tanks 
failed; 

R.H.  tank 
received  minor 
damage 

*This  tank  was  previously  drop  tested  from  39  ft. 


In  March  1985,  the  FAA  issued  ANPRM  85-7  to  elicit  comments  on  the  FAA’s  intent  to 
incorporate  standards  for  crash-resistant  fuel  systems  into  14  CFR  Part  23.  In  response,  the 
General  Aviation  Safety  Panel  (GASP),  an  industry-government  group  formed  at  the  request  of 
the  FAA,  addressed  the  feasibility  of  improving  the  crash  resistance  of  general  aviation  airplane 
fuel  systems.  Although  GASP  felt  that  the  installation  of  crash-resistant  fuel  tanks  in  place  of 
existing  metal  tanks  or  integral  tanks  would  not  be  feasible,  it  did  recommend  the  use  of  self¬ 
sealing  breakaway  valves  at  the  wing/fuselage,  firewall/engine-mount,  and  tip  tank/wing 
junctures  and  the  dry-bay  area  behind  an  engine  if  used  to  carry  fuel.  GASP  also  recommended 
that  any  fuel  tank  located  in  an  engine  nacelle  or  any  fuselage  tank  located  between  the  engine 
and  an  area  occupied  by  either  pilots  or  passengers,  or  any  fuel  tank  external  to  the  wing’s 
contour  (excluding  tip  tanks),  should  comply  with  the  requirements  of  MIL-T-27422B,  with  the 
exception  of  some  lower  requirements  similar  to  those  incorporated  for  the  civil  helicopter  fuel 
tanks. 

The  FAA  issued  NPRM  85-7A  for  Crash-Resistant  Fuel  Systems  in  General  Aviation  Aircraft 
(14  CFR  Part  23)  in  February  1990,  which  incorporated  the  GASP  recommendations  and  also 
included  placing  bladders  in  wing-tip  tanks  and  self-sealing  breakaway  valves  between 
interconnected  tanks.  This  proposed  rule  making  was  canceled  by  the  FAA  in  December  1999 
because  “. ...  the  costs  of  the  proposed  change  are  not  justified  by  the  potential  benefits.” 

Efforts  to  develop  CRFS  components  for  transport  category  airplanes  resumed  following  a  public 
hearing  by  the  FAA  in  June  1977.  The  hearing  was  held  to  obtain  further  information  on  a 
proposed  requirement  for  the  installation  of  an  explosion  prevention  system  for  each  fuel  tank 
and  fuel  vapor  and  vent  space  to  control  postcrash  fuel  system  fires  and  explosions.  The  public 
hearing  confirmed  previously  submitted  written  information  that  fuel  tank  nitrogen  inerting, 
foam  filler,  and  chemical  agent  explosion  suppression  systems,  although  effective  in  preventing 
fire  and  explosion  in  undamaged  fuel  systems,  cannot  prevent  external  fires  caused  by  fuel 
released  from  damaged  fuel  tanks  under  crash  conditions  [52] . 
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It  was  suggested  at  this  hearing  that  antimisting  kerosene  might  reduce  the  fire  hazard  from  fuel 
tanks  damaged  during  a  crash.  Participants  at  the  hearing  also  recommended  that  crash-resistant 
tanks  and  self-sealing  breakaway  valves  be  developed  for  fuselage  fuel  tanks  and  that  breakaway 
valves  be  installed  in  the  fuel  lines  between  tanks  and  engines.  As  a  result  of  this  hearing,  and  a 
second  hearing  in  November  1977  dealing  with  the  fire  worthiness  of  compartment  interior 
materials,  the  FAA  established  the  Special  Aviation  Fire  and  Explosion  Reduction  (SAFER) 
Advisory  Committee  on  June  26,1978.  The  Committee  was  to  “....examine  the  factors  affecting 
the  ability  of  the  aircraft  cabin  occupant  to  survive  in  the  postcrash  environment  and  the  range  of 
solutions  available.” 

The  SAFER  Committee  was  composed  of  24  members  in  addition  to  the  chairman  and  executive 
director.  Airlines,  manufacturers,  universities,  public  and  private  sector  research  establishments, 
flight  and  cabin  crews,  and  consumer  organizations  were  all  represented.  The  Committee  met 
for  the  first  time  in  May  1979  and,  in  view  of  the  short  term  remaining  (13  months),  limited  the 
scope  of  its  activities  to  transport  category  aircraft  and  to  aircraft  design  aspects  relating  to  fire 
and  explosion  reduction  in  impact  survivable  accidents.  To  provide  the  detailed  information 
needed  by  the  Committee,  two  technical  working  groups  were  organized;  one  on  compartment 
interior  materials  and  one  on  postcrash  fuel  system  fire  hazard  reduction.  These  working  groups 
also  employed  specialist  subgroups  to  provide  additional  expertise  in  each  area.  The  subgroups 
in  the  fuel  system  fire  hazard  reduction  group  were  (1)  explosion  suppression,  fuel  tank 
foam/foil,  and  fuel  tank  inerting;  (2)  crash-resistant  fuel  tanks;  and  (3)  antimisting  fuels. 

The  SAFER  Committee  released  its  final  report  in  June  1980  [53].  The  Committee  found  that 
the  major  hazard  in  postcrash  aircraft  fires  is  the  aircraft  fuel  system.  Ignition  of  aircraft  fuel 
spilled  due  to  structural  breakup  during  a  crash  is  the  primary  cause  of  nearly  all  aircraft 
postcrash  fires.  Technical  committee  findings  and  recommendations  for  fuel  system  fire  hazard 
reduction  were  as  follows: 

(1)  Explosion  suppression,  etc.  The  Committee  concluded  that  these  systems  would  be 
effective  only  in  those  cases  of  minor  damage  (no  major  fuel  tank  rupture)  where  external 
fire  would  be  far  less  severe.  In  such  circumstances,  equivalent  protection  could  be 
provided  by  a  flame  arrestor  in  the  fuel  tank  vent  line  and  by  a  system  that  ensures  that 
the  engine  fuel  supply  is  shut  off  in  potential  fire  situations.  Both  suggested 
improvements  were  based  on  existing  technology. 

(2)  Crash-resistant  fuel  tanks.  The  Committee  concluded  that  it  is  feasible  to  install  crash- 
resistant  fuel  cells  in  the  fuselage  and  that  it  may  be  feasible  to  incorporate  some  degree 
of  crash  resistance  in  critical  wing  fuel  tank  locations.  However,  it  is  not  feasible,  in 
most  conventional  transport  airplanes,  to  install  crash-resistant  fuel  tanks  in  the  wings. 

(3)  The  Committee  felt  that  antimisting  fuels  held  the  most  promise  for  reducing  the  fuel  fire 
hazard,  although  more  development  and  testing  was  needed  before  feasibility  could  be 
established. 

Two  additional  Committee  recommendations  were  made  that  are  very  pertinent  to  reducing  the 
fuel  fire  hazard.  One  was  to  develop  realistic  airplane  crash  scenarios  with  emphasis  on  crash- 
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induced  fuel  system  failure  modes  and  their  effects  on  postcrash  fire  safety.  Fuel  system  design 
criteria  and  regulations  could  then  be  developed  using  the  crash  scenarios  as  a  basis.  The  second 
recommendation  was  that  the  FAA  and  NTSB  jointly  improve  and  standardize  postcrash 
accident  investigations  with  added  emphasis  on  identifying  the  role  of  design  features  that  affect 
the  development  and  spread  of  postcrash  fires.  Features  that  contribute  to  fire  safety  as  well  as 
those  that  contribute  to  fire  hazards  should  be  identified.  (This  topic  is  discussed  in  more  detail 
in  section  4.)  The  SAFER  Committee  also  pointed  out  that  the  differing  definitions  of  “impact- 
survivable”  accidents  complicate  CRFS  design  for  transport  airplanes,  but  offered  no  alternative 
definition. 

Note:  The  basic  tenet  of  CRFS  design  is  to  produce  a  fuel  system  which  will  contain  its  fuel  (or 
minimize  spillage)  in  accidents  up  to  the  limits  of  human  survivability.  The  U.S.  Army 
and  the  NTSB  both  define  a  “survivable  accident”  as  one  in  which  an  occupiable  space  is 
maintained  around  the  occupant  and  impact  forces  transmitted  to  the  restrained  occupant 
do  not  exceed  human  tolerance  limits.  The  FAA,  on  the  other  hand,  has  historically 
defined  survivable  accident  as  one  in  which  at  least  one  occupant  survives  the  impact.* 
Neither  of  these  definitions  is  acceptable  for  transport  airplane  design  purposes. 

The  U.S.  Army  definition  has  been  used  quite  successfully  for  many  years  as  a  basis  for 
crashworthy  design.  This  is  possible  because  of  the  relatively  small  size  of  helicopters 
(and  small,  general  aviation  airplanes)  which  ensures  that  the  aircraft  as  a  whole,  and  the 
occupants  therein,  experience  comparable  forces  during  an  impact.  In  transport  airplanes, 
however,  the  large  size  of  the  aircraft  allows  different  sections  of  the  aircraft  (and  their 
occupants)  to  experience  dissimilar  forces  during  a  crash,  sometimes  by  an  order  of 
magnitude  or  more.  Therefore,  the  question  arises  as  to  what  part  of  the  airplane  the 
survivable  definition  should  be  applied  to  -  the  fuel  tank  area  or  areas  away  from  the  fuel 
tank  which  may  experience  lower  crash  loads? 

On  the  other  hand,  the  FAA  definition  of  survivable  crash  is  based  on  the  outcome  of  the 
accident,  which  furnishes  no  basis  at  all  from  which  the  designer  may  work.  Outcomes 
are  often  unpredictable  and  undefined  for  the  accident  population  as  a  whole.  Without 
defining  some  predictable  limits,  a  sound  engineering  basis  for  design  is  impossible. 

Defining  realistic  upper  limit  crash  scenarios  based  on  accident  data  would  be  a  logical 
beginning.  Fuselage  section  and  full-scale  airplane  crash  testing  to  these  scenarios  could 
then  furnish  the  necessary  data  upon  which  crashworthy  designs  could  be  based. 

The  recommendation  by  the  SAFER  Committee  to  develop  realistic  crash  scenarios  resulted  in 
the  FAA  awarding  contracts  to  three  major  domestic  transport  airplane  manufacturers  in  1980  to 
examine  transport  accident  data  in  depth  and  to  develop  candidate  impact-survivable  accident 
scenarios  for  use  in  future  crashworthiness  R&D  efforts  [52],  The  results  of  these  studies  were 
published  in  1982  and  are  discussed  in  detail  in  section  4.  Based  on  these  studies,  three  distinct 
scenarios  with  associated  impact  conditions  were  suggested,  as  shown  in  table  2-4  [54], 


Proposed  AC25-17A  contains  a  definition  of  survivable  crash  which  is  a  modified  version  of  the  U.S.  Army  and 
NTSB  definition,  see  section  8. 3.4. 3. 
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TABLE  2-4.  TRANSPORT  AIRCRAFT  CANDIDATE  SCENARIOS 


IMPACT  CONDITIONS 

Candidate 

Scenario 

Operational 

Phase 

Distance 

From 

Airport 

Forward 

Velocity 

(Vf) 

Sink 

Rate 

(Vs) 

Airplane 

Configuration/ 

Impact 

Conditions 

Terrain 

Hazard 

Ground 

to 

Ground 

(overrun) 

Takeoff 

abort/landing 

overrun 

On 

runway  or 
within 

3000  ft! 
of  end  of 
runway 

60-100  kts 

Less 
than  or 
equal  to 

5  fps. 

Gear  extended 
Symmetrical 

Runway 

Hard 

Ground 

Ditches 

Trees 

Mounds 

Light 

Stanchions 

Air  to 
Ground 

(Hard 
Landing)  ^ 

Landing-hard 

Landing- 

undershoot 

On 

runway  or 
within 

300  ft.  of 
threshold 

126-160 

kts 

Greater 
than  5 
fps.  but 
less  than 
or  equal 
to  12  fps 

Gear  extended 

Symmetrical 

Runway 

Soft 

Ground 

None 

Air  to 

Ground 

(Impact) 

Final 

Approach 

On 

runway  or 

between 

outer 

marker 

and 

missed 

approach 

point 

Greater 
than  126 
kts 

Greater 

than 

12  fps 

Gear  extended 
retracted 
Symmetrical 
Unsymmetrical 

Pitch  0°  -  5° 

Roll  5° -45° 

Yaw  0°-10° 

Flight  Path 

-4°  -  -7° 

Hard 

Ground 

Hilly 

Rocky 

Trees 

Poles 

Slopes 

Ravines 

Buildings 

The  studies  concluded  that  the  greatest  potential  for  improved  transport  crashworthiness  was  in 
reducing  fire-related  fatalities  (severe  fuel  fires  accounted  for  approximately  36  percent  of  the 
fatalities  in  survivable  accidents).  Leading  candidates  for  crash-resistant  improvements  were  the 
stmctural  integrity  of  fuel  systems  and  fuselages  and  landing  gear  that  are  more  tolerant  of  off- 
runway  conditions. 

Also,  in  view  of  the  SAFER  Committee  report,  the  FAA  accelerated  its  existing  program  on 
antimisting  kerosene  (AMK).  Following  intensive  investigations,  including  full-scale  ground 
and  flight  tests,  a  B-720  airplane  operating  on  AMK  was  flown  remotely  in  a  controlled  impact 
test  to  demonstrate  the  effectiveness  of  AMK  in  an  impact-survivable  accident.  (This  program  is 
described  in  section  2.4.)  However,  the  demonstration  indicated  that  control  of  the  fuel  fire  with 
AMK  was  not  yet  feasible. 

Therefore,  in  1985,  the  FAA  awarded  a  contract  to  a  major  domestic  airplane  manufacturer  to 
identify  potential  fuel  containment  concepts  for  reducing  the  postcrash  fire  hazard  in  the  crash 
scenarios  previously  identified.  During  this  program,  an  analysis  of  available  crash  test  data  and 
accident  data  allowed  the  researchers  to  develop  the  cause  and  effect  relationships  shown  in 
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figiirs;  2-10  [55],  Based  on  this  data,  several  approaches  were  formulated  to  improve  fuel 
containment  during  survivable  crashes.  These  were: 

•  Approach  No.  1  -  Component  Improvements 

Crash-resistant  fuel  system  components 

Self-sealing  breakaway  valves  (potential  use  in  engine  fuel  feed  line  at  pylon) 
Frangible  fittings 

Flexible  lines  (used  now  where  there  is  a  high  stretch  potential  and  where  relative 
displacement  is  anticipated) 

SAFER  Committee  recommendations 

Vent  flame  arrestor 
Emergency  shutoff  valves 

•  Approach  No.  2  -  Wing  Structural  Modifications 

Wing  span  changes  (front  spar,  leading  edge,  lower  skin,  forward  skin  redesign,  and 
strengthening  similar  to  reference  43) 

Wing  root  changes 

Increased  strength 

Double  wall  construction 

Spanwise  compartmentation  of  tanks  (would  need  self-sealing  fittings  at  cell-to-cell  lines 
and  wing  root) 

Energy  absorbing  devices 

•  Approach  No.  3  -  Fuselage  Fuel  Containment 

Crash-resistant  fuel  tank  material 
Crash-resistant  fuel  system  components 

The  above  concepts  were  analyzed  regarding  benefits  and  penalties  and  prioritized  in  order  of 
effectiveness  based  on  the  ratio  of  fleet  penalty  (weight  plus  cost)  to  fatality  reduction.  The 
author  concluded  that  fuselage  fuel  containment  (Approach  No.  3)  rated  highest  and  had  the 
greatest  near-term  potential.  Wing  structural  modifications  would  be  long-term  goals,  but 
fuselage  fuel  containment,  along  with  wing  root  structural  modifications,  would  ultimately  be  the 
most  effective  approach.  The  least  effective  was  structural  modification  of  the  wing  span. 
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Structure  Related 

Initial  Structure 

i 

Fire  Hazard 

Event 

Involved 

Subsequent  F  ailures 

Consequences 

Main  gear  collapse 
or 

Retracted  gears 


Wing  impact 


Engine  separation 
Wing  overload 
Lower  wing  tear 


Fuel  line  rupture 
Fuel  tank  rupture 


Fuselage  impact 


Fuselage  break/separation 
Fuselage  crush  - 


Penetration  into 
Wing  box 


Wing  tank  overload 


Loss  of  center  or 
Fuselage  fuel  tank  integrity 

Loss  of  wing  fuel  tank 
integrity 


Contour  or 
Slope  impact 
(gears  collapsed) 


Fuselage  impact 

Wing  impact 
(distributed  load) 


Fuselage  break  impact 
Wing  overload  _ 

Lwr  wing  tear 

Engine  separation 


Columns  or 
Obstacle  penetration 


Wing  penetration 

(concentrated 

load) 

Fuel  tank  rupture 


Wing  overload 
Fuel  tank  overload 


Loss  of  center  or 
fuselage  wing  tank 
integrity 


1 -  Fuel  line  rupture 


Fuel  tank  rupture 
Fuel  tank  puncture 
Fuel  line  rupture 


FIGURE  2-10.  ACCIDENT  EVENTS  WHICH  LEAD  TO  A  FIRE  HAZARD 

The  study  determined  that  design  practices  for  fuselage  fuel  tanks  could  be  separated  into  two 
distinct  categories.  One  category  consisted  of  using  bladder  cells  in  the  lower  fuselage  of  wide- 
body  transports  between  the  front  and  rear  spars  of  the  wing  carry-through  structure  (see  figure 
2-11).  This  installation  avoids  sections  where  the  fuselage  is  likely  to  break  during  a  crash.  The 
surrounding  beams  and  bulkheads  provide  stiffness  and  support  in  event  of  a  gear-up  impact  with 
the  ground.  The  fuel  system  components  are  located  within  the  cell,  protecting  them  to  a  certain 
extent.  The  author  recommended  that  a  more  tear-  and  crash-resistant  bladder  be  used  to 
improve  the  tank’s  crash  resistance.  In  addition,  energy  absorbing  crushable  structure  (i.e., 


2-33 


sandwich  construction  or  equivalent)  should  be  used  between  the  tank  cell  and  lower  fuselage 
skin. 


FIGURE  2-11.  BLADDER  CELL  INSTALLATION  WIDE-BODY  TRANSPORT  AIRPLANE 

The  other  category  of  fuselage  fuel  tank  in  use  consisted  of  a  bladder  within  a  dedicated 
structural  box.  This  type  of  tank  is  used  in  both  narrow-  and  wide-body  airplanes.  It  is  generally 
located  in  the  lower  fuselage  cargo  compartment.  The  tank  is  composed  of  an  aluminum 
honeycomb  outer  shell  with  two  bladder  cells  inside.  It  is  supported  from  the  passenger  floor 
beams  and  ftiselage  frame  as  shown  in  figure  2-12.  This  design  allows  for  tank  displacement 
relative  to  aircraft  structure  and  affords  some  available  crush  distance  above  the  bottom  fuselage 
skin.  The  fuel  and  vent  lines  connecting  the  auxiliary  tanks  to  the  main  fuel  system  incorporate 
drainable  and  vented  shrouds.  In  addition,  these  lines  are  either  designed  to  break  away  from  the 
auxiliary  tank  or  sufficient  stretch  is  provided  to  accommodate  tank  movement  without  causing 
fuel  spillage.  The  author  recommended  using  more  tear-resistant  bladders  and  self-sealing 
breakaway  valves  in  the  lines  to  make  the  tanks  more  crash  resistant. 

Analytical  studies  (done  by  the  KRASH  computer  program)  also  were  conducted  during  this 
program.  The  analysis  was  based  on  air-to-ground  and  ground-to-ground  ftiselage  impacts  with 
no  obstacles  [55],  These  studies  showed  that  initial  sink  velocities  in  excess  of  22  ft/sec  with 
zero  pitch  would  likely  break  the  fuselage  shell  and  crush  the  fuselage  underside  14  to  24  inches. 


2-34 


FIGURE  2-12.  FUSELAGE  FUEL  TANK  GENERAL  ARRANGEMENT  AND 

ATTACHMENT 

The  researchers  suggest  the  velocity  envelope  depicted  in  figure  2-13  be  used  for  crash  design 
purposes  because  the  airframe  should  not  break  up  within  this  envelope  and,  thus,  could  be 
considered  survivable. 
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FIGURE  2-13.  SUGGESTED  VELOCITY  ENVELOPE  FOR  STRUCTURAL 
INTEGRITY  BASED  ON  PRELIMINARY  KRASH  STUDIES 

A  follow-on  study  conducted  by  the  same  manufacturer  was  performed  to  evaluate  the 
performance  under  crash  conditions  of  three  contemporary  fuselage  fuel  tank  installations  [56], 
These  installations  were  the  two  described  previously  plus  a  relatively  small  (160  to  440  gal) 
double-wall,  cylindrical  strap-in  tank.  These  cylindrical  tanks  are  generally  located  in  an  area 
where  adequate  fuselage  crush  is  anticipated  and  away  from  break/separation  regions.  The 
author  recommends  relocating  the  interconnecting  lines  from  below  the  tanks  and  external  to 
above  the  tanks  and  internal,  where  possible,  to  improve  their  crash  resistance.  Also 
recommended  is  the  use  of  flexible  lines  and  breakaway  fittings,  as  well  as  redundant  support 
structure  to  prevent  the  tanks  from  breaking  free. 

The  KRASH  computer  program  was  used  to  develop  anticipated  fuselage  responses  during  a 
crash.  The  crash  conditions  did  not  include  any  obstacle  impacts  either  to  the  fuselage  or  to  the 
wings.  The  KRASH  analysis  was  used  to  generate  a  proposed  crash  design  velocity  envelope  for 
floor-mounted  components.  The  potential  criteria  were: 


Dynamic  Pulse  (Triangular  Shape) 

Vertical  -  only 

Velocity  change,  Av 
Rise  time,  tr 
Peak  acceleration 

Longitudinal  -  only 

Velocity  change,  AAv 
Rise  time,  tr 
Peak  acceleration 


=  25  ft/sec 
=  0.075  sec 
=  10.4  g 


=  30  ft/sec 
=  0.10  -  0.09  sec 
=  9.3- 10.2  g 
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The  fuselage  underside  crush  distribution,  based  on  both  test  and  analysis  data,  was: 

•  Forward  of  wing  section  14  inches 

•  Wing  center  section  10  inches 

•  Aft  of  wing  section  16  inches 

A  series  of  tests  to  evaluate  various  fuel  tank  installations  and  crash-resistant  components  was 
proposed.  Two  types  of  section  tests  were  proposed  to  assess  the  performance  of  fuselage  fuel 
tank  installations;  a  longitudinal  impact  and  a  vertical  impact  with  accelerations  and  velocity 
changes  within  the  envelopes  recommended  above. 

Note:  While  these  tests  might  be  a  reasonable  starting  point  for  evaluating  the  performance  of 
the  tank  structure  and  installation  hardware  under  dynamic  loads,  it  should  be  noted  that 
these  tests  simulate  only  one  of  the  three  crash  scenarios  of  survivable  accidents,  the 
other  two  scenarios  involving  impacts  into  obstacles  or  uneven  ground.  In  addition,  there 
are  many  instances  in  the  accident  records  where  occupants  have  survived  crashes  in 
which  the  fuselage  has  broken  apart  and,  in  fact,  where  occupants  have  used  these  breaks 
as  emergency  exits.  Thus,  although  the  recommended  test  parameters  might  be  sufficient 
for  occupants  near  the  fuel  tanks,  occupants  farther  away  from  the  tank  location  might 
see  considerably  lower  forces.  If  the  tank  were  to  fail  only  slightly  above  the  test 
conditions,  many  occupants  still  might  be  put  at  risk  of  fire  injuries  or  death  during 
otherwise  survivable  crashes. 

In  the  early  1980s,  NASA  and  the  FAA  each  conducted  several  drop  tests  of  transport  airplane 
fuselages  to  acquire  structural  response  data  for  computer  programs  such  as  DYCAST  and 
KRASH,  which  were  being  developed  for  crash  analysis  of  aircraft  structures.  The  FAA 
expanded  its  test  program  during  the  1990s  to  include  seats,  overhead  bins,  and  fuselage  fuel 
tanks.  These  tests  are  described  in  section  3. 

2.4  MODIFIED  FUEL. 

Aircraft  crash  testing  following  World  War  II  (WWII)  showed  that  ruptured  fuel  tanks  dump 
large  quantities  of  jet  fuel  into  the  air  stream  before  the  airplane  comes  to  rest.  The  fuel  is 
sheared  into  fine  mist  as  it  travels  through  the  air.  The  mist  is  explosively  flammable, 
susceptible  to  ignition  by  sparks,  hot  engine  parts,  electrical  arcing,  and  other  conditions  that 
occur  coincident  to  the  crash  sequence.  Once  the  mist  is  ignited,  the  flame  front  propagates 
explosively  back  to  the  point  where  the  fuel  was  released  and  a  large  fire  can  rapidly  consume 
the  airplane  before  passengers  can  escape. 

Those  concerned  with  accident  injury  prevention  concluded  early  on  that  mitigation  of  the 
postcrash  fuel  misting  phenomenon  could  be  a  key  to  reducing  the  number  and  severity  of 
postcrash  fires  and  their  resulting  carnage. 

2.4.1  Antimisting  Kerosene. 

Decreasing  the  susceptibility  of  aviation  kerosene  fuel  to  atomizing  (misting)  soon  became 
recognized  as  the  most  readily  feasible  methodology  to  reduce  fuel  misting.  Thickening  or 
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gelling  known  fuels  could  be  employed  to  reduce  their  susceptibility  to  flowing  after  tanks  and 
lines  were  breached.  By  making  the  thicker  fuels  cohesive,  they  would  be  less  likely  to  atomize 
during  the  immediate  postcrash  spillage,  and  later  spills  would  be  minimized  by  the  resistance  of 
the  fuels  to  flow  readily. 

The  U.S.  Army  and  the  FAA  began  conducting  research  into  gelled  and  emulsified  fuels  in  the 
mid-1960s  in  hopes  that  they  could  find  a  means  for  reducing  the  number  of  injuries  and  deaths 
caused  by  postcrash  fires.  The  U.S.  Army’s  research,  the  more  extensive  of  the  two,  was  an 
attempt  to  evaluate  fuel  emulsification  in  dynamic  crash  conditions.  The  U.S.  Army  testing 
progressed  from  laboratory  experiments  through  60  full-scale  fuel  cell  impact  tests,  which 
demonstrated  that  the  emulsified  kerosene  fuels  (JP-8  and  Jet-A)  significantly  reduced  fire 
hazards  in  the  postcrash  environment  [57], 

Although  the  U.S.  Army’s  experiments  achieved  encouraging  results  in  laboratory  settings 
dealing  solely  with  the  characteristics  of  the  fuels,  the  emulsified  fuel  burned  profusely  when 
crash  tested  in  three  T-33  jet  trainers.  These  early  failures  opened  the  door  to  much  more 
complex  research  designed  to  develop  utilitarian  methodologies  for  using  a  modified  fuel  in 
aircraft  during  real-world  operating  conditions. 

In  1978,  the  FAA  entered  into  a  cooperative  effort  with  the  United  Kingdom’s  (UK)  Royal 
Aeronautical  Establishment  (RAE)  and  NASA  to  investigate  the  feasibility  of  achieving  the 
transition  of  AMK  from  the  laboratory  to  regular  aircraft  operations.  In  corollary  inquiry  the 
SAFER  Technical  Group  on  Postcrash  Fire  Hazard  Reduction  studied  AMK  progress  to  date  and 
concluded  that: 

“Although  it  appears  to  be  the  most  promising  candidate  to  reduce  the  fire  hazard 
in  a  post-crash  environment,  much  more  development  effort  will  be  required 
before  this  potential  can  be  realized”  [53], 

At  the  time  (1979),  the  antimisting  additive  under  study  was  FM-9™,  a  proprietary  material 
produced  by  Imperial  Chemical  Industries  (ICI)  in  the  UK.  The  cooperative  U.S. /UK  agreement 
encompassed  research  in  both  countries  until  the  end  of  1980,  at  which  time  a  decision  would  be 
made  either  to  continue  development  or  abandon  the  concept  as  unworkable.  The  SAFER  Anti- 
Misting  Kerosene  Sub-Committee  identified  several  factors  critical  to  AMK’s  transition  to 
operational  usage: 

•  Fundamental  properties  of  the  AMK/FM-9™  mixture  and  acceptable  variances 

•  “Degradation”  or  “restoration”:  return  of  the  AMK  fuel  mixture  to  its  base  fuel  state 

•  AMK  production,  quality  control,  and  stability 

•  Effects  of  water  on  AMK 

•  Effects  of  AMK  on  engines  and  engine  components 

•  Actual  fuel-air  shear  (anti-misting)  experiments  testing  fuel  release  rates  and  airspeeds 

•  Large-scale  crash  tests  to  determine  performance  in  actual  airplane  crash  conditions 


2-38 


The  Sub-Committee  concluded  that: 


“The  use  of  AMK  will  significantly  reduce  the  fire  and  explosion  hazard  in  a 
survivable  accident  by  significantly  reducing  the  propagation  of  flame  through 
fuel  mists  such  as  might  occur  during  an  aircraft  crash”  [53]. 

The  Sub-Committee  recommended  that  research  continue  beyond  1980,  the  terminal  date  of  the 
FAA/UK  agreement,  especially  into  those  areas  noted  above  where  robust  scientific  data  were 
lacking. 

In  September  1980,  the  FAA  initiated  an  Engineering  and  Development  Program  Plan  on 
Antimisting  Fuel.  Later  revised  in  1985  after  the  Controlled  Impact  Demonstration  (CID),  the 
plan  set  up  a  phased  research  program  to: 

•  Determine  the  feasibility  of  antimisting  fuel; 

•  Develop  recommendations  for  introduction  and  use  in  civil  aviation; 

•  Assess  its  effectiveness  in  a  controlled  impact  demonstration;  and 

•  Assess  its  economic  reasonableness  in  support  of  regulatory  actions  [58]. 

2.4.2  The  Controlled  Impact  Demonstration. 

The  CID  was  designed  to  demonstrate  that  (1)  a  jet  transport  airplane  could  operate  solely  on 
AMK;  and  (2)  in  a  representative  crash  scenario,  the  AMK  would  prevent  an  airborne  fuel  mist 
from  forming  to  support  an  explosive  conflagration  and  limit  the  airborne  fireball  that  had 
proved  so  deadly  in  past  crashes.  The  Boeing-720  CID  airplane  was  to  be  remotely  piloted  and 
crashed  onto  a  prepared  impact  site  in  a  scenario  that  would  result  in  a  “survivable”  accident.  It 
would  be  representative  of  typical  takeoff,  approach,  landing,  or  missed  approach  accident. 

The  impact  scenario  had  the  airplane  on  a  3.3°  to  4.0°  glide  path  with  a  1°  nose-up  attitude  on  its 
final  approach.  With  a  sink  rate  of  about  17  fps  and  neither  roll  nor  yaw,  it  would  hit  the  ground 
at  145-155  kt  ground  speed.  The  crash  severity  of  the  scenario  would  be  within  the  survivable 
range.  The  landing  gear  would  be  retracted  to  increase  fuselage  impact  forces.  The  impact  site 
had  been  prepared  with  a  packed  stone  bed  to  provide  a  friction  ignition  source  over  which  the 
airplane  would  slide.  Eight  heavy  steel  structures  were  imbedded  in  concrete  within  the  impact 
site,  aligned  to  rip  open  the  wing  fuel  tanks  and  guarantee  fuel  spillage.  Operating  approach 
lights  were  mounted  in  the  slideout  area  to  serve  as  electrical  sources  of  ignition.  Two  jet-fueled 
flame  generators  were  installed  in  the  720’ s  tail  cone  to  imitate  the  ignition  potential  of  aft- 
mounted  engines  and  ensure  ignition  as  the  airplane  slid  through  the  spilled  fuel  in  the  event  all 
other  ignition  sources  failed. 

There  were  73  dummies  stationed  within  the  cabin,  of  which  13  were  fully  anthropomorphic. 
The  13  were  fitted  with  accelerometers  in  the  head,  thorax,  and  pelvis  to  measure  impact  and 
postimpact  forces  transmitted  to  “passengers.”  Additional  force  sensors  (175)  were  installed  in 
the  wings,  fuselage,  galley,  floor,  and  overhead  storage  compartment.  Sensor  data  were  recorded 
both  onboard  the  plane  and  telemetered  to  external  recorders. 
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The  B-720  was  also  equipped  with  1 1  high-speed  motion  picture  and  video  cameras  inside  the 
cabin,  one  high-speed  movie  camera  on  top  of  the  vertical  stabilizer,  and  two  video  cameras  and 
a  movie  camera  in  the  nose.  About  a  hundred  cameras  were  positioned  around  the  crash  site. 
The  memorializing  crew  was  rounded  out  by  two  photo  helicopters  and  a  U.S.  Navy  photo 
reconnaissance  plane  equipped  with  long-range,  high-speed  cameras. 

In  December  1984,  the  CID  B-720  took  off  from  Edwards  AFB,  CA,  loaded  with  11,325  gallons 
of  inline  blended  AMK.  Winds  were  less  than  5  kts.  The  plane  intercepted  its  final  approach 
path  at  2300’  above  ground  level  (agl)  and  began  descent.  At  the  150’  agl  abort  decision 
altitude,  it  was  on  its  150  kt  ground  speed,  but  slightly  below  glide  slope  and  to  the  right  of  final 
approach  course.  As  the  remote  pilot  attempted  to  correct  the  flight  path,  the  left  outboard  (#1) 
engine  struck  the  ground  410  feet  short  of  the  target  box.  The  plane  was  in  a  2°  nose-down 
attitude,  yawed  13°  left.  It  immediately  rolled  about  10°  left  wing  down,  and  the  left  inboard  (#2) 
engine  and  fuselage  struck  the  ground  immediately  thereafter.  Both  left  engines  spooled  down  to 
cutoff  and  separated  at  the  pylons  within  two  seconds,  prior  to  reaching  the  wing-cutters.  By 
then,  its  ground  speed  had  slowed  from  152  to  122  kts.  It  slid  500  feet  before  hitting  the  first  of 
the  eight  steel  wing-cutters  at  a  38°  yaw  angle. 

By  the  time  the  plane  contacted  the  first  wing-cutter,  the  swept  leading  edge  of  its  right  wing  was 
almost  perpendicular  to  the  centerline  of  the  impact  zone,  and  both  right  engines  (#3  and  #4) 
were  still  running.  The  first  wing-cutter  entered  the  right  side  of  the  #3  engine  nacelle  and 
continued  through  the  engine,  stopping  the  compressor  within  one  revolution.  The  cutter  broke 
loose  from  its  anchoring  and  rotated  upwards  under  the  wing,  cutting  into  the  inboard  main  fuel 
tank.  Simultaneously,  the  second  right-hand  cutter  ripped  into  the  bottom  of  the  wing,  inboard  of 
the  #3  engine,  causing  sufficient  additional  damage  to  separate  the  right  wing. 

The  severed  wing  rotated  forward  ahead  of  the  sliding  airplane,  releasing  its  fuel  into  an  area  of 
turbulence  and  recirculation  that  undoubtedly  sheared  the  AMK,  potentially  degrading  it  to  its 
previous  Jet-A  flammability  characteristic.  Rupture  of  the  engines  released  AMK  which  had 
been  restored  prior  to  injection  into  the  engines,  as  well  as  oil  and  hydraulic  fluid.  Ignition 
occurred  within  0.14  second  of  the  wing-cutter  puncturing  the  engine  and  tank  and  resulted  in  an 
initial  fireball  that  seemed  to  have  all  the  characteristics  of  traditional  fuel  mist  explosions. 

Because  of  its  dependence  on  idiosyncratic  rigidity,  the  CED  scenario  departed  drastically  from  a 
“representative”  crash.  To  assure  that  the  CID  would  demonstrate  what  its  sponsors  desired  to 
display,  the  impact  area  was  designed  to  achieve  predetermined  rupture  of  the  plane’s  fuel  cells 
and  preplanned  spillage  precisely  where  it  would  be  kindled  by  the  prepositioned  ignition 
sources.  Those  outcomes  depended  on  the  B-720  striking  the  ground  precisely  within  a  small 
50-  x  200-ft  landing  area.  As  each  physical  obligation  was  added  to  the  scenario,  the  likelihood 
of  achieving  every  planned  outcome  diminished  inversely. 

The  FAA,  NASA,  and  ICI  were  all  convinced  of  the  efficacy  of  AMK  prior  to  the  CID.  They 
thought  of  the  CID  not  as  a  test,  but  as  a  performance  for  the  public  with  extensive  press 
coverage.  Unfortunately,  the  performance  got  out  of  control.  The  plane  landed  outside  the 
planned  envelope  and  the  demonstration  reverted  to  an  experiment  in  which  the  outcome  was  no 
longer  predictable. 
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Plane  crashes  seldom  go  according  to  plan.  AMK  had  already  been  proved  to  be  safer  than 
ordinary  jet  fuel  under  a  variety  of  crash  circumstances.  In  retrospect,  it  would  have  been 
appropriate  to  demonstrate  the  effectiveness  of  AMK  in  a  more  typical  crash  scenario,  rather 
than  in  the  contrived  environment  attempted  by  the  sponsors.  Indeed,  it  is  worthwhile 
contemplating  the  results  of  the  CfD  had  the  heavy  steel  “cutters”  been  absent  from  the  landing 
area,  even  with  the  same  off-target  landing. 

Ironically,  it  was  precisely  the  by-products  of  public  demonstration  that  led  to  the  perception  that 
the  CID  was  a  failure.  Television  coverage  transmitted  instantaneous  images  that  the  controlled 
crash  had  turned  into  a  massive  uncontrolled  fuel-fed  fire.  Images  of  the  fireball  and  plumes  of 
black  smoke  gave  the  impression  of  disaster  in  the  desert.  If  the  public  had  held  any  hope  for 
AMK’s  minimizing  the  extent  of  postcrash  fuel  fires,  it  was  dashed  by  those  depictions. 

Yet  the  opposite  was  true.  Despite  the  visual  imagery,  the  initial  fireball  did  not  penetrate  the 
fuselage.  Later  analyses  showed  that  AMK  splashing  over  the  fuselage  actually  cooled  it  and 
helped  prevent  bum  through.  The  initial  fireball  went  out  in  8  to  9  seconds,  leaving  substantial 
time  for  survivors  of  the  initial  impact  to  have  escaped  before  the  subsequent  fuselage  fire 
erupted.  And  that  fire  penetrated  the  fuselage  primarily  at  breaches  opened  by  the  misaligned 
cutters  which  had  been  emplaced  to  rip  open  the  fuel  tanks.  Although  the  conventional  wisdom 
argues  that  similar  structures  would  not  often  be  found  in  a  crash  site,  in  at  least  two  recent 
accidents  the  fuselage  was  penetrated  and  the  fuel  tanks  breached  by  external  mechanisms  not 
wholly  unlike  the  CID’s  wing-cutters:  the  USAir  1493  B-737/Wings  West  Swearingen  Metro  at 
Los  Angeles  International  (LAX),  and  AAL  1420’s  MD-80  at  Little  Rock  (LIT). 

The  CID  fires  were  not  attacked  by  the  firefighting  means  normally  associated  with  FAR  139  air 
carrier  airports.  The  secondary  fire  finally  burned  itself  out  after  1  1/2  hours.  A  final  testament 
to  the  efficacy  of  AMK’s  reduced  flammability  was  9,000  gallons  of  unbumt  fuel  which 
remained  in  and  around  the  airplane. 

What  might  have  been  the  case  had  the  CID  gone  according  to  plan?  In  their  book  The  Golem  at 
Large,  Harry  Collins  and  Trevor  Pinch  commented: 

“We  can  easily  imagine  the  demonstration  going  according  to  plan,  the  Boeing  720 
landing  wheels-up  without  bursting  into  flames,  and  the  TV  cameras  entering  the 
fuselage  of  the  unbumt  aircraft  and  revealing  pictures  of  putatively  smiling 
unscorched  dummies.  Yet  that  scene  too  hides  some  hidden  questions.  Could  it  be 
that  the  particular  crash  was  unusually  benign  so  that  AMK  has  the  potential  to  make 
a  difference  on  only  very  few  crashes?  Could  it  be  that  the  extra  machinery  needed  to 
turn  jelly-like  fuel  into  liquid  before  it  enters  the  engines  of  jet  planes  would  itself  be 
a  cause  of  crashes?  Could  it  be  that  the  transition  period,  requiring  two  types  of  fuel 
to  be  available  for  two  types  of  plane,  would  be  so  hazardous  as  to  cost  more  lives 
than  the  new  fuel  would  ever  save?  Could  it  be  that  the  extra  cost  of  re-equipping 
airlines,  airports,  and  airplanes,  might  jeopardize  safety  in  other  ways  at  a  time  of 
ruthless  competition  in  the  airline  market?  Again,  perhaps  there  was  too  little  time 
for  anyone  to  escape  between  first  and  second  fires;  perhaps  cabin  temperatures  rose 
so  much  during  the  first  fireball  that  everyone  would  have  been  killed  anyway 
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(authors’  note:  absence  of  suitable  temperature  and  toxic  byproduct  recording 
devices  was  an  obvious  omission  in  CID  planning);  perhaps  there  is  always  unbumt 
fuel  left  after  a  major  crash;  perhaps  everyone  would  have  died  of  fright”  [59], 

While  the  CID  remains  a  topic  of  considerable  debate,  and  while  speculation  is  unending  about 
what  might  have  occurred  if  the  demonstration  had  proceeded  according  to  plan,  the  practical 
result  of  the  CID  was  that  serious  interest  in  pursuing  the  use  of  AMK  or  other  antimisting  fuels 
disappeared.  That  result  is  the  ultimate  tragedy  of  the  CID.  The  likelihood  of  being  able  to 
design  a  cost-effective  CRFS  for  large  transport  aircraft  that  will  protect  all  occupants  in  all 
locations  within  the  aircraft  from  postcrash  fire  injuries  and  death  is  remote  [60].  The  aircraft 
fuel  systems  are  so  complex,  their  components  are  distributed  in  so  many  locations  in  the 
aircraft,  and  the  crash  loads  experienced  by  various  portions  of  the  aircraft  are  so  diverse  that  it 
is  highly  unlikely  that  there  will  never  be  an  unsafe  spillage  of  fuel.  For  those  reasons,  the  best 
single  contribution  to  eliminating  postcrash  fires  would  be  the  development  of  a  fuel  that  is  hard 
to  spill,  and  if  spilled  is  extremely  difficult  to  ignite  outside  the  engine,  and  if  ignited  would 
incorporate  self-extinguishing  characteristics.  Research  should  be  reinstituted  on  developing 
such  a  fuel. 
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3.  TRANSPORT  CATEGORY  AIRPLANE  CRASH  TESTS. 


3.1  TEST  DESCRIPTIONS. 

Many  full-scale  crash  tests  of  transport  category  airplanes  were  conducted  during  the  early 
efforts  to  define  the  postcrash  fire  problem  and  find  solutions  that  would  prevent  or  minimize 
crash  fires.  These  tests,  which  have  been  described  in  section  2,  were  conducted  using  airplanes 
designed  and  constructed  before  the  advent  of  modem  jet  transports.  The  FAA’s  Controlled 
Impact  Demonstration  (CID)  test  utilizing  AMK  is  the  only  full-scale,  forward-moving  crash  test 
of  a  transport  category  airplane  conducted  since  the  1960s.  (Because  of  the  unique  nature  and 
complexity  of  the  CID,  it  has  been  described  by  itself  in  section  2.4.2.)  However,  the  drop  tests 
and  sled  tests  described  in  this  section  were  all  conducted  using  contemporary  transport  airplane 
fuselages,  thus  yielding  data  that  is  directly  applicable  to  current  aircraft. 

Two  vertical  drop  tests  of  Boeing  707  fuselage  sections  were  conducted  by  NASA  in  the  early 
1980s.  These  tests  were  conducted  to  acquire  structural  response  data  to  corroborate  the 
DYCAST  computer  program  and  to  determine  structural,  seat  and  occupant  response  to  vertical 
loads  to  prepare  for  the  upcoming  CID  test.  The  test  sections  included  some  passenger  seats 
with  instrumented  dummies  but  no  fuel  system  components. 

The  first  test  utilized  a  12-ft-long  fuselage  section  located  just  forward  of  the  wing  [61].  The 
vertical  test  velocity  was  20  ft/sec.  The  lower  fuselage  section  (baggage  compartment)  collapsed 
inward  near  the  section  centerline  approximately  2  feet.  This  collapse  was  caused  by  bending 
failures  on  both  sides  of  the  fuselage  at  one-third  of  the  vertical  height  between  the  fuselage 
bottom  and  floor,  as  shown  in  figure  3-1.  The  maximum  vertical  acceleration  at  the  bottom  of 
the  fuselage  was  20  G’s  while  that  at  floor  level  it  was  only  12  G’s  because  of  the  cmshing  of  the 
under  floor  structure. 

As  can  be  seen  in  figure  3-1,  the  section  is  open  on  both  ends.  As  the  researchers  who  conducted 
the  test  pointed  out,  the  crash  response  of  a  fuselage  section  would  depend  upon  the  transmission 
of  forces  and  moments  of  inertia  from  the  rest  of  the  structure.  They  felt  this  interaction  would 
be  very  difficult  to  simulate  and,  therefore,  used  a  very  simple  tension  cable  system  to  provide 
outward  radial  restraint  only.  It  is  unclear  how  much  this  configuration  might  affect  the 
magnitude  of  the  results. 

The  second  drop  test  utilized  a  13-ft-long  section  located  at  the  rear  of  the  wing.  This  center 
section  included  the  wheel  wells,  keel  beam,  and  part  of  the  rear  wing  spar,  as  shown  in  figure  3- 
2  [62],  Test  velocity  also  was  20  ft/sec.  There  was  no  damage  to  the  fuselage  or  floor. 
Maximum  acceleration  on  the  fuselage  bottom  equaled  71  G’s.  The  extremely  stiff  structure 
transmitted  high  loads  to  the  floor,  seats,  and  dummies  in  contrast  to  the  lower  loads  transmitted 
by  the  softer  structure  ahead  of  the  wing. 
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FIGURE  3-1.  POSTTEST,  FRONTAL  VIEW  OF  TRANSPORT  SECTION 

FORWARD  OF  WING 
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A  third  drop  test  of  a  B-707  fuselage  section  was  conducted  at  the  FAA’s  Technical  Center  in 
1984  to  develop  and  refine  the  test  methodology  [63],  This  forward  fuselage  section  also  was 
dropped  at  20  ft/sec.  The  fuselage  was  instrumented  with  structural  accelerometers  and 
displacement  transducers  (rod  potentiometers)  between  the  bottom  of  the  fuselage  and  the 
bottom  of  the  cabin  floor.  One  instrumented  dummy  was  onboard,  but  there  were  more  dummies 
in  other  seats.  The  fuselage  was  dropped  onto  a  load-measuring  platform.  The  dynamic  crush, 
obtained  from  the  accelerometer  data,  was  18.4  in.  (Data  from  the  displacement  transducers  was 
not  valid  because  of  lateral  displacement  of  the  attachments  as  the  structure  crushed.)  The 
measured  static  crush  was  14.5  in.  The  crush  pattern  is  shown  in  figure  3-3.  The  dummy  data 
indicated  that  the  impact  was  not  injury  producing.  Several  recommendations  were  made  to 
improve  the  test  methodology,  including  new  attachments  for  the  potentiometers  and  the  use  of 
digitized  high-speed  film  data  to  determine  dynamic  crush. 


FIGURE  3-3.  DEFORMATION  OF  B-707  FORWARD  FUSELAGE  SECTION  FOLLOWING 

DROP  TEST 

Several  months  after  the  B-707  drop  test,  an  aft  fuselage  section  of  a  DC- 10  was  dropped  at  the 
FAA’s  Technical  Center  using  the  same  test  setup  and  protocol  [64].  The  vertical  velocity  was 
also  20  ft/sec.  All  of  the  damage,  which  was  slight,  occurred  below  the  cargo  floor  and  was  due 
to  the  buckling  of  the  vertical  supports  for  the  cargo  floor  structure.  This  has  been  the  only  test 
of  a  wide-body  airplane  fuselage  conducted  to  date. 
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Typical  acceleration  data  from  the  section  tests  are  shown  in  figures  3-4  and  3-5.  The  much 
higher  accelerations  generated  by  the  stiffer  structure  of  the  narrow-body  center  section,  in 
contrast  to  the  softer  forward  section,  can  be  seen  in  figure  3-4.  Also  of  interest  is  the  difference 
in  acceleration  levels  across  the  width  of  the  fuselage  center  section.  This  difference  is 
not  noticeable  in  the  overall  softer  structure  forward  of  the  wing.  The  accelerations  of  the  wide- 
body  section,  shown  in  figure  3-5,  are  much  less  than  those  of  the  narrow-body  center  section 
(figure  3-4(a)),  but  somewhat  higher  than  those  of  the  softer  forward  section  (figure  3 -4(b)). 


Time,  sec  Time,  sec 

(a)  Center  Section 


(b)  Forward  Section 

FIGURE  3-4.  ACCELERATION  TIME  HISTORIES  OF  B-707  FUSELAGE 

SECTION  DROP  TESTS 
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TIME,  SEC. 

(b)  PASSENGER  FLOOR  CENTERLINE 


TIME,  SEC. 

(a)  PASSENGER  FLOOR/FLOOR  POST 
INTERSECTION 


FIGURE  3-5.  WEDE-BODY  FRAME  SECTION  TEST  RESULTS 

In  June  1984,  a  complete  B-707  airplane  (minus  landing  gear)  was  drop  tested  to  evaluate  the 
airframe  strength  characteristics.  Data  from  this  test  were  used  to  refine  the  KRASH  model  for 
the  upcoming  CID  test  [64],  The  drop  test  was  structured  to  simulate  the  planned  CID  impact 
conditions  except  for  forward  velocity  and  aerodynamic  loading.  Sink  speed  was  17  ft/sec. 
Pitch  attitude  was  1  degree  nose  up  and  roll  was  0  degrees. 


After  the  test,  the  lower  fuselage  of  the  B-707  was  crushed  and  frame  failures  were  noted  on  the 
centerline  and  along  the  sidewall.  The  extent  of  damage  was  greater  in  the  aft  region  than  in  the 
forward  cargo  bay.  Estimated  crush  was  about  2  in.  aft  of  the  nose  gear  bulkhead;  4  in.  forward 
of  the  wing  leading  edge;  and  11  to  13  in.  aft  of  the  main  landing  gear  bulkhead.  Crushed 
ducting  along  the  wing  box  keel  indicated  that  the  structure  had  deflected  at  least  6  in.  in  this 
area.  The  bulkhead  at  the  wing  trailing  edge  ruptured  and  pushed  the  floor  upward  at  least  4  in. 
at  the  center,  severing  the  transverse  beams  and  seat  tracks  at  that  location.  Since  no  floor 
accelerations  were  recorded,  the  observed  damage  could  not  be  related  with  quantitative 
response  levels. 


There  was  no  wing  fuel  tank  damage  due  to  impact  except  at  the  wing  tip,  which  initially 
contacted  the  ground  as  the  wing  flexed.  The  upper  strut  attach  points  of  the  left  wing  inboard 
engine  pylon  failed,  but  the  engine  lodged  between  the  wing  and  the  ground. 


The  FAA  conducted  two  longitudinal  tests  on  a  10-ft  section  of  a  B-707  several  years  later  to 
generate  baseline  data  for  KRASH  and  other  analytical  programs  [65].  The  fuselage  section  was 
just  forward  of  the  rear  galley.  It  contained  three  rows  of  two  triple-passenger  seats  with 
dummies  in  each  seat.  The  seats  had  been  strengthened  to  meet  the  higher  expected  loads. 
There  were  no  fuel  system  components  onboard.  The  fuselage  was  mounted  on  a  Hyge  sled  and 
tested  at  input  levels  of  7.4  G’s  (22  ft/sec)  and  at  14.2  G’s  (36  ft/sec).  Neither  the  fuselage  shell 
nor  the  floor  structure  was  damaged.  The  floor  and  fuselage  accelerations  were  basically  the 
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same.  Peak  accelerations  were  7.6-7. 8  G’s  for  the  lower  speed  test  and  14.7-15.0  G’s  for  the 
higher  speed  test. 

In  1992,  the  FAA  conducted  a  vertical  drop  test  on  a  commuter  category  Metro  III  airplane 
fuselage  [66].  The  purpose  of  the  test  was  to  measure  the  structural  response  of  the  fuselage, 
floor,  seats  (standard  and  modified),  and  dummies.  The  test  setup  is  illustrated  in  figure  3-6. 
The  engines  and  nacelles  of  this  low-wing  aircraft  are  below  the  lower  molding  of  the  fuselage 
structure.  It  was  assumed  that  they  would  contact  the  ground  prior  to  or  simultaneously  with  the 
fuselage.  Thus,  the  inertial  loads  from  the  wings  and  engines/nacelles  would  be  directly  reacted 
by  the  ground  and  not  transferred  into  the  fuselage.  Therefore,  their  mass  was  not  critical  to  the 
test  results  and  the  wings  were  removed,  so  there  were  no  fuel  tanks  or  engines  on  the  test  article. 
The  landing  gear  and  vertical  and  horizontal  stabilizers  also  had  been  removed,  leaving  only  the 
fuselage  with  the  center  wing  box.  The  vertical  impact  velocity  was  26.32  ft/sec.  Peak 
accelerations  were  40  to  60  G’s  throughout  the  airframe.  Deformation  along  the  entire  length  of 
the  fuselage  was  less  than  2  inches. 


40  FT. 
(REF.) 


ELECTRICAL  WINCH 


FIGURE  3-6.  DROP  TEST  SETUP  FOR  METRO  III  FUSELAGE 


Several  years  later  (1995)  another  vertical  drop  test  was  conducted  on  a  commuter  category 
airplane — a  Beechcraft  1900C  [67].  The  Beechcraft  is  a  low-wing,  twin-turboprop  airplane.  The 
purpose  of  the  test  was  to  measure  the  impact  response  of  the  fuselage,  cabin  floor,  seats 
(standard  and  modified),  and  dummies.  As  in  the  Metro  III  test,  the  wings,  engines,  landing 
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gear,  and  vertical  and  horizontal  stabilizers  were  removed  prior  to  the  test;  thus,  there  were  no 
fuel  tanks  onboard.  The  fuselage  was  dropped  from  a  height  of  1 1.2  ft,  impacting  with  a  velocity 
of  26.8  ft/sec.  Accelerations  on  the  fuselage  were  140  to  160  G’s,  but  acceleration  levels  on  the 
dummies  showed  that  this  was  a  severe  but  definitely  survivable  impact.  Deformation  along  the 
bottom  of  the  fuselage  ranged  from  0.3  to  1.6  in.,  the  latter  occurring  in  the  empennage  portion 
of  the  fuselage. 


The  first  test  in  which  any  part  of  the  fuel  system  was  involved  occurred  in  1993.  A 
vertical  drop  test  was  conducted  by  the  FAA  of  a  10-foot  tapered  section  of  a  Boeing  707  [68]. 
Figure  3-7  illustrates  the  test  configuration.  Seats  and  dummies  were  installed  to  achieve  the 
desired  test  weight.  The  outer  floor  beams  at  each  end  of  the  section  were  reinforced  to 
minimize  the  open  end  effects.  The  focal  points  of  the  test  were  the  overhead  bins  and  the 
auxiliary  fuel  tank.  The  auxiliary  fuel  tank  was  a  330-gallon,  double-wall  cylindrical  tank 
mounted  in  a  cradle  which  was  attached  to  the  underside  of  the  fuselage  floor,  in  the  area  noted 
in  figure  3-8.  The  tank  contained  water  to  simulate  the  weight  of  a  tank  full  of  fuel  and  was 
pressurized  to  2.5  psi. 


FIGURE  3-7.  DROP  TEST  CONFIGURATION  FOR  A  B-707  FRAME  SECTION 

WITH  AUXILIARY  FUEL  TANK 
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BS  -  Body  Station 


FIGURE  3-8.  B-707  TEST  SECTION— SIDE  VIEW 

The  fuselage  section  was  dropped  onto  a  load-measuring  platform.  Impact  was  at  30  ft/sec.  The 
average  fuselage  maximum  acceleration  was  36  G’s  for  a  57  msec  idealized  triangular  pulse. 
Measured  peak  G’s  ranged  from  32  G’s  at  the  front  to  44  G’s  at  the  rear.  The  average  maximum 
fuel  tank  deceleration  was  about  31  G’s.  The  force  applied  on  the  tank  was  distributed  to  the 
cradles  and  straps  supporting  the  tank.  The  data  from  the  test  dummies  indicated  that  the  impact 
was  severe  but  survivable  and  moderate  injuries  could  have  been  expected.  The  authors  noted 
that  the  measured  accelerations  were  higher  than  expected  because  the  installation  of  the 
auxiliary  fuel  tank  prevented  additional  fuselage  crushing. 

Figure  3-9  shows  the  fuselage  section  following  impact.  The  crush  of  the  lower  fuselage 
averaged  16.6  in.  at  the  front  and  6.4  in.  at  the  rear.  Maximum  crush  was  19.6  in.  at  the  left 
front.  The  auxiliary  fuel  tank  remained  attached  but  the  center  lower  surface  of  the  tank  crushed 
inward  approximately  4  in.  due  to  the  protrusion  of  the  fuel  discharge  line  hardware.  Both  the 
inner  and  outer  walls  cracked  around  the  welding  of  the  fuel  line  outlet,  allowing  fluid  to  leak 
out.  It  was  concluded  that  the  redesign  of  the  fuel  tank  discharge  plumbing  might  prevent  such 
tank  rupture  and  leakage. 
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FIGURE  3-9.  FRONT  VIEW  OF  TEST  SECTION  AND  FUEL  TANKS  AFTER  IMPACT 

The  next  test  of  a  fuselage  fuel  tank  came  during  a  series  of  three  longitudinal  acceleration  tests 
on  a  10- ft  fuselage  section  of  a  Boeing  737,  Model  200  conducted  in  1997.  These  tests  were 
conducted  at  the  Transportation  Research  Center  using  their  24-inch  Hyge  sled  [69],  The 
fuselage  section  was  configured  with  two  stowage  bins  and  a  500-gallon  auxiliary  fuel  tank 
located  in  the  cargo  area.  The  fuel  tank  was  a  Patrick  Aircraft  Tank  System  attached  to  the 
underside  of  the  cabin  floor  beams,  as  shown  in  figure  3-10.  The  tank  was  filled  with  water.  All 
of  the  tests  involved  triangular  acceleration  pulses.  Peak  sled  accelerations  for  Tests  1,  2,  and  3 
were  6.1,  8.2,  and  14.2  G’s  respectively.  Corresponding  test  velocities  were  23.2,  32.2,  and  41.7 
ft/sec. 

There  was  no  visual  evidence  of  fuselage  or  stowage  bin  deformation  during  Test  1.  However, 
the  auxiliary  fuel  tank  broke  loose  from  its  attachment  framework  approximately  75  to  85  msec 
into  the  acceleration  pulse.  It  was  eventually  restrained  by  the  test  fixture  approximately  50 
msec  later,  after  it  had  moved  almost  two  feet.  The  front  edges  of  the  tank’s  aluminum  side  rails 
had  sheared  off  against  the  front  stops  of  the  attachment  framework  and  the  lower  attachment 
straps  had  broken  loose  from  the  airframe’s  cargo  floor.  Recorded  acceleration  data  was 
compromised  when  the  tank  impacted  the  test  fixture,  producing  data  spikes  in  the  cabin  floor 
accelerations.  The  tank  was  removed  for  the  next  two  tests. 
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FIGURE  3-10.  AIRFRAME  TEST  SECTION  WITH  AUXILIARY  FUEL  TANK  INSTALLED 

In  October  1998,  a  Shorts  3-30  regional  transport  airplane  was  subjected  to  a  vertical  drop  test 
[70].  This  aircraft  is  a  high- wing,  twin-turboprop  airplane  with  a  capacity  of  30  passengers.  The 
entire  aircraft,  minus  landing  gear,  was  dropped,  as  shown  in  figure  3-11.  The  main  object  of  the 
test  was  to  determine  the  impact  responses  of  the  fuselage,  seat  tracks,  seats,  and  test  dummies. 
However,  because  of  the  unique  configuration  and  location  of  the  fuel  system,  it  also  was 
included  in  the  test.  The  fuel  system  contains  two  fuel  tanks  which  are  located  on  top  of  the 
fuselage,  as  shown  in  figure  3-12.  Each  tank  holds  288  gal  of  fuel  and  is  composed  of  two 
interconnected  fuel  cells.  Although  cells  1,  2,  and  3  are  physically  housed  together  while  cell  4 
is  separate,  cells  3  and  4  are  interconnected  and  make  up  one  of  the  tanks.  The  tanks  were 
approximately  3/4  full  of  water  to  simulate  a  full  tank  of  fuel.  All  of  the  fuel  lines  coming  from 
the  tanks  were  capped  but  the  interconnect  pipe  between  cells  3  and  4  was  left  in  place. 
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FIGURE  3-11.  DROP  TEST  SETUP  FOR  SHORTS  3-30  AIRPLANE 


CELL  3-4 


FIGURE  3-12.  SHORTS  3-30  FUEL  SYSTEM 
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The  airplane  was  dropped  with  an  impact  velocity  of  28  ft/sec.  The  maximum  fuselage 
acceleration  was  approximately  90  G’s  with  a  pulse  duration  of  15  msec  (measured  at  the  floor). 
Maximum  crush  was  1.3  in.  with  the  average  crush  under  the  floor  only  about  0.1  in.,  indicating 
a  very  stiff  structure.  Acceleration  measurements  on  the  dummies  showed  a  severe  impact 
which  would  have  resulted  in  moderate  to  severe  injuries  to  the  occupants. 

The  external  upper  section  of  the  fuselage  sustained  significant  deformation  because  both  fuel 
tanks  intruded  into  the  cabin  area  1  to  1.5  ft,  due  mainly  to  the  load  the  fuel  tanks  exerted  on  the 
fuselage  ceiling.  The  fuel  tanks  broke  loose  from  their  mountings  and  large  quantities  of  fluid 
spilled  directly  onto  the  dummies.  There  were  numerous  rips  and  tears  in  the  tanks,  the  four 
gravity  feed  outlets  were  crushed,  and  fluid  leaked  from  the  interconnect  pipes.  (See  figures  5-9 
and  5-10  in  section  5.) 

The  large  quantity  of  fluid  spilled  would  make  a  fire  likely  in  the  event  of  a  real-world  crash. 
This,  coupled  with  the  fact  that  the  occupants  would  be  drenched  in  fuel,  would  be  catastrophic. 


The  most  recent  drop  test  was  conducted  by  the  FAA  in  October  1999  [71],  A  B-737  fuselage 
section  containing  several  rows  of  seats,  test  dummies,  and  an  underfloor  auxiliary  tank  was 
dropped  from  a  height  of  14  ft.  The  fuel  tank,  shown  in  figure  3-13,  was  a  double-wall  metal 
tank  with  honeycomb  between  the  walls.  There  was  no  bladder  inside  the  tank. 
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Fluid  leakage  from  the  fuel  tank  was  readily  apparent  as  a  steady  flow.  This  leakage  was 
reported  as  being  caused  by  the  lower  fuselage  frame  puncturing  the  fuel  tank.  The  posttest 
damage  to  the  fuselage  is  shown  in  figures  3-14  to  3-16.  The  cabin  floor  above  the  fuel  tank  was 
pushed  upward  several  inches  because  of  the  incompressibility  of  the  full  tank,  reportedly 
generating  high  G  loads  on  the  seats. 


FIGURE  3-14.  POSTTEST  VIEW  OF  A  B-737  FUSELAGE  SECTION 


FIGURE  3-15.  BUCKLED  FUSELAGE  FRAME  FORWARD  OF  AUXILIARY  FUEL  TANK 
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(b)  Posttest 


FIGURE  3-16.  FUSELAGE  UNDERFLOOR  STRUCTURE  AND 
AUXILIARY  FUEL  TANK 
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3.2  SUMMARY  OF  TEST  RESULTS. 


The  test  conditions  and  results  are  summarized  in  table  3-1.  Two  points  are  immediately  obvious 
upon  examining  the  maximum  G  levels  and  the  maximum  crush  obtained  during  these  tests: 
first,  the  smaller  commuter  airplanes  (Metro  III,  Beechcraft  1900C  and  Shorts  3-30)  all  have 
much  stiffer  structures  relative  to  the  aircraft  size  and  weight  than  the  larger  transports,  with 
correspondingly  smaller  crush  distances  and  higher  G  levels;  and  second,  the  variations  in 
stiffness  of  the  larger  transport  airplane  structure  depending  on  the  part  of  the  fuselage  involved. 
The  variation  is  easily  seen  when  comparing  the  results  of  the  first  two  drop  tests  of  the  B-707 
involving  the  softer  structure  ahead  of  the  wing  and  the  stiff  structure  just  aft  of  the  wing 
(including  the  rear  wing  spar,  wheel  wells,  and  keel  beam).  This  difference  in  stiffness  is  also 
apparent  in  the  B-707  test  with  the  cylindrical  auxiliary  fuel  tank  where  the  crush  in  the  front  of 
the  test  section  was  over  twice  that  in  the  rear.  These  results  indicate  that,  when  designing  a 
fuselage  fuel  tank  installation,  the  stiffness  (potential  G  level  and  crush  distance)  of  the  specific 
planned  tank  location  must  be  factored  into  the  design  rather  than  relying  on  generalized  stiffness 
data  for  the  overall  fuselage. 

The  tests  conducted  so  far  have  involved  three  different  fuel  system  configurations.  None  of 
these  fuel  system  installations  performed  entirely  satisfactorily  during  tests  that  were  well  within 
the  range  of  human  survivability.  Clearly  more  work  needs  to  be  done  to  improve  the  crash 
safety  of  the  fuselage  auxiliary  fuel  tanks  and  later  sections  of  this  report  address  potential 
improvements  and  issues  involved.  The  main  fuel  system  of  the  Shorts  3-30  is  outside  the  scope 
of  the  current  study,  but  the  serious  deficiencies  of  the  fuel  system  performance  from  the 
standpoint  of  fire  safety  are  noteworthy.  Improved  fuel  system  design  would  surely  improve  the 
fuel  system  crash  performance. 

The  crush  measurements  from  the  complete  B-707  airplane  test  compared  to  the  results  of  the 
various  section  tests  raise  some  questions  about  using  the  section  test  structural  data  for  design 
purposes.  The  section  tests  showed  that  open-ended  sections  could  crush  more  then  might  be 
expected.  Yet,  the  complete  fuselage  test  crushed  more  in  the  center  section  than  the  comparable 
section  test,  probably  due  to  wing  loading. 

The  section  tests  do  seem  to  be  a  valid  method  of  testing  components  (e.g.,  overhead  bins,  seats, 
and  auxiliary  fuel  tanks)  in  air-to-ground  impacts  with  no  obstacles  involved.  However,  the 
vertical  drop  tests  and  longitudinal  sled  tests,  although  providing  some  indication  of  crash  loads 
and  crushing  which  might  be  encountered,  do  not  test  other  forces  and  failure  mechanisms  which 
are  more  prevalent  in  actual  crashes  and  that  would  be  expected  to  affect  fuselage  fuel  tank 
integrity.  These  mechanisms  include  combined  longitudinal  and  vertical  forces,  the  effect  of 
obstacle  impacts,  and  extensive  structural  displacement  as  the  aircraft  is  being  tom  apart. 
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TABLE  3-1.  SUMMARY  OF  AIRPLANE  FUSELAGE  IMPACT  TESTS 


Section  Tests 

Aircraft 

Impact 

Direction 

Impact 

Velocity/fps 

Maximum 

G 

Pulse 

Duration/ms 

Max. 

Crush/in. 

Avg. 

Crush/in. 

Fuel 

System 

F.  S. 

Performance 

B-707  (fwd  of  wing) 

Vertical 

20 

20 

NR 

24 

NR 

No 

NA 

B-707  (center) 

Vertical 

20 

71 

NR 

No  Damage 

NR 

No 

NA 

B-707  (fwd) 

Vertical 

20 

NR 

NR 

18.4  (dyn) 
14.5  (s) 

NR 

No 

NA 

B-707  (aft) 

Longitudinal 

22 

7.8 

NR 

NA 

NA 

No 

NA 

B-707  (aft) 

Longitudinal 

36 

15 

NR 

NA 

NA 

No 

NA 

B-707  (aft) 

Vertical 

30 

36 

19.6  (front) 
8.4  (rear) 

16.6  (front) 
6.4  (rear) 

Aux. 

(cylind) 

a) 

B-737  (fwd) 

Longitudinal 

23.2 

6.1 

NR 

NA 

NA 

Aux. 

(PATS) 

(2) 

B-737  (fwd) 

Longitudinal 

32.2 

8.2 

NR 

NA 

NA 

No 

NA 

B-737  (fwd) 

Longitudinal 

41.7 

14.2 

NR 

NA 

NA 

No 

NA 

DC-10  (aft) 

Vertical 

20 

~37 

NR 

~2 

NR 

No 

NA 

Complete  Fuselage  Tests 

Aircraft 

Impact 

Direction 

Impact 

Velocity/fps 

Maximum 

G 

Pulse 

Duration/ms 

Max. 

Crush/in. 

Avg. 

Crush/in. 

Fuel 

System 

F.  S. 

Performance 

Metro  III 

Vertical 

26.32 

40-60 

NR 

<2 

NR 

No 

NA 

Beechcraft  1900C 

Vertical 

26.8 

140-160 

NR 

1.6 

NR 

No 

NA 

Shorts  3-30 

Vertical 

28 

90 

15 

1.3 

0.1  (under 
floor) 

Main 

(overhead) 

(3) 

B-707 

Vertical 

17 

NR 

NR 

2  (front)  1 3 
(rear) 

NR 

wing 

(4) 

(1)  Leaked  from  cracks  around  fuel  discharge  line  outlet.  NR  Not  Reported 

(2)  Fuel  tank  broke  loose.  ^A  -  Not  Applicable 

(3)  Fuel  tanks  broke  loose.  Massive  spillage  onto  occupants  inside  cabin. 

(4)  Damage  at  wing  tip;  engine  pylon  attach  points  failed. 

One  additional  result  should  be  noted.  Dummy  measurements  in  the  vertical  drop  tests  indicate 
that  all  these  tests  produced  forces  which  were  survivable.  Although  the  velocity  changes  were 
comparable  to  those  recommended  for  crashworthy  design  based  on  results  from  the  KRASH 
program  (see  section  2.3),  the  peak  accelerations  obtained  from  the  test  data  are  considerably 
higher  than  those  recommended.  Times  to  reach  peak  G  were  also  longer  in  the  tests. 
Additional  test  data  which  could  be  utilized  to  refine  the  KRASH  program  still  further  might 
resolve  this  discrepancy. 
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4.  TRANSPORT  AIRPLANE  ACCIDENT  DATA. 


4.1  THE  PISTON  ERA. 

In  1949,  NACA  published  a  bibliography  of  unclassified  aircraft  fire  literature  [72]  that  lists 
studies  of  postcrash  fire  from  as  far  back  as  1922.  This  awareness  of  the  problem,  along  with  the 
high  rate  of  in-flight  fires,  was  a  major  concern  to  aircraft  designers  in  the  post-WWH  era. 

One  of  the  early  U.S.  studies  of  the  transport  crash  fire  problem  [2]  reported  that  postcrash  fire 
occurred  in  about  15  per  cent  of  U.S.  air-carrier  accidents  in  1946  and  about  30  percent  of  the 
occupants  died  from  the  fire  in  these  accidents.  This  report  then  reviewed  fuel  properties  and 
ignition  sources  for  both  in-flight  fires  and  postcrash  fires. 

A  1951  report  by  a  Civil  Aviation  Authority  (CAA)  engineer  at  an  SAE  meeting  [73]  indicated 
that,  between  1938  and  1951,  crashes  not  followed  by  fire  were  fatal  to  60.8  percent  of  the 
occupants,  and  in  crashes  followed  by  fire,  the  rate  was  84.6  percent  fatal.  This  paper  discussed 
test  work  on  bladder  tanks  and  self-sealing  fittings,  as  well  as  findings  from  accident 
investigations. 

A  civil  Aeronautics  Board  (CAB)  study  in  1966  covered  153  accidents  occurring  in  1955-1964 
that  were  caused  by  or  resulted  in  fire  [74],  Of  the  4,559  passengers  and  crew  members 
involved,  1,955  persons  were  fatally  injured,  and  2,604  persons  survived  with  varying  degrees  of 
injury  ranging  from  severe  to  none.  Fifty  one  (33%)  of  the  153  accidents  were  severe  enough  to 
fatally  injure  all  onboard.  An  additional  28  (18%)  accidents  had  fatalities  and  survivors.  These 
accidents  had  a  total  of  1,161  occupants,  of  which  488  (42%)  died.  Of  these  deaths,  294  (60%) 
were  due  to  fire.  An  additional  57  occupants  were  seriously  burned.  Of  the  1,955  occupants  in 
the  79  fatal  and  partially  survivable  accidents,  294  (15%)  died  due  to  the  fire.  The  report 
provides  a  detailed  description  of  some  of  the  accidents  where  there  were  both  fatalities  and 
survivors  and  points  up  the  need  for  additional  work  on  fire  prevention  in  design,  as  firefighting 
capability  is  rarely  available  during  the  short  evacuation  period  after  impact. 

4.2  THE  JET  ERA. 

In  1975,  a  NASA  study  by  Stanford  Research  Institute  covered  accidents  occurring  to  U.S. 
commercial  aircraft  during  the  period  1963-1974  [75],  The  focus  was  on  determining  the  degree 
to  which  materials  with  improved  fire  resistance  and/or  decreased  toxicity  could  reduce  injuries, 
fatalities,  and  fire  damage.  During  this  period,  there  were  545  nonturbulence  accidents,  of  which 
122  (22%)  had  a  fire  in  the  airframe.  (They  excluded  accidents  where  there  was  no  airframe 
damage  and  those  where  fires  were  confined  to  the  engine  and/or  wheel  well.)  While  only  22% 
of  these  accidents  had  fires,  75%  of  the  fatal  accidents  involved  fire.  In  at  least  21  of  the  122  fire 
accidents,  the  impact  damage  was  relatively  light  and  the  fire  damage  was  severe.  Nearly  half  of 
the  fire  accidents  were  on  landing.  Overall,  about  15%  of  the  fatalities  were  due  to  fire,  the  same 
figure  as  in  the  1966  study. 

Of  the  71  fatal  accidents  involving  fire,  39  were  not  impact  survivable,  13  had  some  fatalities 
definitely  caused  by  fire  and  19  were  not  designated  impact  survivable  or  nonsurvivable  (but  13 
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of  these  may  have  been  survivable).  Thus,  in  at  least  45  (63%)  of  these  fatal  accidents  it  was 
immaterial  whether  fire  occurred  or  not. 

In  the  same  time  frame,  Horeff  [76]  reviewed  382  substantial  damage  accidents  and  incidents  to 
U  S.  and  foreign  operators  which  were  considered  impact  survivable,  i.e.,  not  all  occupants  were 
fatally  injured.  Of  these,  37  had  fatalities.  There  were  42  approach  accidents,  of  which  22  were 
fatal.  Fire  occurred  in  16  of  the  22  fatal  and  4  of  the  20  nonfatal  approach  accidents.  There  were 
179  landing  accidents,  of  which  4  were  fatal.  Fire  occurred  in  3  of  the  fatal  and  35  of  the  non¬ 
fatal  landing  accidents.  There  were  56  takeoff  accidents,  of  which  7  were  fatal  and  involved  fire, 
with  all  95  deaths  attributed  to  fire.  Of  the  37  occurring  in  flight,  one  aircraft  experienced  an  in¬ 
flight  fire  followed  by  an  off  airport  landing,  resulting  in  123  fatalities  due  to  fire.  In  19  cases, 
wing  separation  occurred.  Fire  accounted  for  over  one-third  of  the  deaths  in  these  accidents.  In 
15  cases,  fuel  tank  damage  occurred;  7  of  the  15  were  fatal  and  fire  accounted  for  about  30%  of 
the  deaths.  Fuel  was  released  from  tanks  in  22  cases  without  fire.  Seven  fire  accidents  had 
reports  of  fuel  line  or  engine  fuel  release;  two  were  fatal  and  all  91  deaths  were  due  to  fire. 
There  were  16  cases  of  fuel  tank  explosions,  4  from  electrostatic  sparks  and  12  from  heating  due 
to  external  fires.  Combining  survivable  and  nonsurvivable  fatal  accidents  during  this  time 
period,  about  16%  of  the  2455  deaths  were  due  to  fire. 

Another  report  covering  almost  the  same  time  period  was  produced  by  the  NTSB  in  1977  [77], 
This  was  intended  as  a  follow-on  to  reference  74  and  reviews  the  changes  in  the  air  carrier 
business  during  the  interim  between  reports.  These  changes  included  moving  almost  completely 
to  a  pressurized  jet  fleet  with  a  better  structural  environment,  better  seat  and  restraint  systems, 
greater  use  of  kerosene  and  better  engine  fire  extinguishing  systems.  The  number  of  fire 
accidents  decreased  slightly  (153  to  141)  but  the  number  of  persons  exposed  to  these  accidents 
increased  significantly,  from  4559  to  7043,  due  to  larger  aircraft  and  high-load  factors.  In 
addition,  the  accident  rate  decreased  while  number  of  flights  and  seat-miles  increased  rapidly. 
Of  greater  significance  to  postcrash  fire  studies,  the  ratio  of  fatalities  from  all  causes  to  the  total 
number  of  occupants  in  fire  accidents  decreased  from  43%  to  26%  during  this  period.  This 
means  an  occupant  had  a  65%  better  chance  of  surviving  the  fire  accident  in  the  latter  period 
compared  to  the  former.  In  addition,  an  occupant  who  survived  the  impact  had  a  37%  better 
chance  of  escaping  the  fire.  However,  due  to  higher  passenger  loads  and  thus  increased  numbers 
exposed  in  each  accident,  the  total  number  of  fire  fatalities  remained  almost  constant  in  the  two 
periods,  297  compared  to  292.  The  percentage  of  accidents  to  U.S.  air  carriers  in  all  operations 
in  which  fire  occurred  increased  from  18.6  to  25.3. 

Two  factors  were  identified  to  account  for  the  changes  in  fire  accident  data.  Turbojet-powered 
aircraft  accounted  for  an  increasing  percentage  of  all  flights,  with  their  greater  reliability, 
structural  integrity,  changed  operating  environment  and  use  of  different  fuel.  Secondly, 
improved  fire  protection  regulations,  improved  interior  materials,  and  improved  engine  reliability 
reduced  in-flight  fires  and  their  associated  hazards.  No  change  could  be  noted  in  the  effect  of 
increased  availability  of  airport  crash/fire/rescue  on  survivability  between  the  periods.  Most  of 
the  regulatory  changes  in  this  area  were  to  take  effect  after  1975. 

In  1980,  the  NTSB  published  a  Special  Study  “General  Aviation  Accidents:  Postcrash  Fires  and 
How  to  Prevent  or  Control  Them”  [78].  In  this  study  of  22,002  general  aviation  accidents  during 
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1974  to  1978,  they  noted  that  postcrash  fire  occurred  in  8%  of  the  accidents  and  that  59%  of 
postcrash  fire  accidents  resulted  in  fatalities.  They  reviewed  the  history  of  postcrash  fire 
prevention  efforts,  surveyed  the  state-of-the-art  technology,  and  showed  how  the  U.S.  Army’s 
efforts  had  succeeded  in  reducing  helicopter  fire  deaths  by  the  application  of  the  techniques  in 
the  Crash  Survival  Design  Guide.  They  also  reviewed  the  minimal  regulatory  provisions  dealing 
with  postcrash  fire  and  made  six  recommendations  to  the  FAA  for  corrective  action.  Some  are 
applicable  to  transport  aircraft.  They  were 

“Amend  the  airworthiness  regulations  to  incorporate  the  latest  technology  for 
flexible,  crash-resistant  fuel  lines  and  self-sealing  frangible  fuel  line  couplings  at 
least  equivalent  in  performance  to  those  used  in  recent  FAA  tests  and  described  in 
Report  No.  FAA-RD-78-28  for  all  newly  certificated  general  aviation  aircraft. 

(Class  II,  Priority  Action)  (A-80-91)” 

“Amend  the  airworthiness  regulations  to  incorporate  the  latest  technology  for 
light  weight,  flexible  crash-resistant  fuel  cells  at  least  equivalent  in  performance 
to  those  used  in  recent  FAA  tests  and  described  in  Report  No.  FAA-RD-78-28  for 
newly  certificated  general  aviation  aircraft  having  nonintegral  fuel  tank  designs. 

(Class  II,  Priority  Action)  (A-80-91)” 

“Require  after  a  specified  date  that  all  newly  manufactured  general  aviation 
aircraft  comply  with  the  amended  airworthiness  regulations  regarding  fuel  system 
crashworthiness.  (Class  II,  Priority  Action)  (  A-80-92)” 

“Fund  research  and  development  to  develop  the  technology  and  promulgate 
standards  for  crash-resistant  fuel  systems  for  aircraft  having  integral  fuel  tank 
designs  equivalent  to  the  standards  for  those  aircraft  having  nonintegral  fuel  tank 
designs.  (Class  II,  Priority  Action)  (A-80-93)” 

“Assess  the  feasibility  of  requiring  the  installation  of  selected  crash-resistant  fuel 
system  components,  made  available  in  kit  form  from  manufacturers,  in  existing 
aircraft  on  a  retrofit  basis  and  promulgate  appropriate  regulations.  (Class  II, 

Priority  Action)  (A-80-94)” 

“Continue  to  fund  research  and  development  to  advance  the  state-of-the-art  with 
the  view  toward  developing  other  means  to  reduce  the  incidence  of  postcrash  fire 
in  general  aviation  aircraft.  (Class  II,  Priority  Action)  (A-80-95)” 

In  the  20  years  that  followed,  not  one  of  these  recommendations  was  implemented  for  fixed- 
wing  aircraft.  The  first  two  were  partially  implemented  for  helicopters  in  14  CFR  Parts  27  and 
29. 

The  SAFER  Committee  (see  section  2.3.4)  recommended  in  1980  that  data  collection  and 
verification  from  actual  accident  investigations  be  improved  to  provide  more  robust  validation 
for  theoretical  crash  scenarios.  The  Committee  repeated  earlier  recommendations  by  the 
Coordinating  Research  Council  in  its  Report  #482,  titled  “Aviation  Fuel  Safety  -  1975.” 
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In  the  case  of  Air  Carrier  accidents,  NTSB  Form  6120.2  is  used  in  reporting 
all  civil  aircraft  accidents  involving  aircraft  exceeding  12,500  pounds  takeoff 
weight,  helicopters  and  Alaskan  air  carriers.  Usually  this  form  is  supported 
by  attached  statements  as  well  as  the  report  of  the  Investigation  Team. 

Complete  though  this  form  is,  it  still  lacks  certain  vital  information  relevant 
to  fuel  fires;  unfortunately  the  usual  attachments  to  this  form  in  an  Accident 
File  also  lack  the  information.  A  revision  to  the  form  should  focus  attention 
on  the  need  for  information  relative  to  fuel  and  fires.  [53] 

Form  6120.4  Sup.  C  now  contains  spaces  for  recording  the  fuel  quantities  in  wing,  tip,  and 
fuselage  tanks  and  some  boxes  to  check  regarding  “spillsafe  fittings”  and  fuel  leakage. 
However,  a  review  of  structures  reports  of  recent  transport  accidents  reveals  little  specific  data 
on  fuel  leakage  locations,  whether  or  not  fuselage  tanks  were  installed,  the  presence  or  absence 
of  self-sealing  valves,  etc.  This  information  is  not  stored  in  a  usable  computer  database. 

Accidents  are  rare  events,  and  accidents  which  inteiject  postcrash  fire -related  hazards  into 
otherwise  survivable  circumstances  are  even  more  rare.  Investigative  authorities’  inability  to 
extract  all  available  data  and  information  from  these  infrequent  occurrences  has  inhibited 
identification  of  real  risks  in  real  events.  Unfortunately  the  SAFER  Committee  chose  to 
prioritize  high-cost,  high-risk  AMK  research  in  preference  to  pursuing  relatively  low-cost,  low- 
risk  methodologies  which  would  validate  and  verify  the  data  upon  which  such  choices  were 
made.  The  SAFER  Committee  thereby  violated  its  own  caveat  memorialized  in  its  final  report 
[53]: 


Adequacy  of  Aircraft  Accident  Data 

A  sound  plan  of  attack  on  any  safety  problem  must  start  with  a  careful  analysis  of 
the  accident  data  in  order  to  pinpoint  the  true  causes  of  accidents  and  identify 
effective  remedies.  Otherwise,  we  may  devote  large  amounts  of  limited  resources 
to  solving  the  wrong  problem. 

One  of  the  more  recent  detailed  accident  studies  was  reported  by  Boeing  Commercial  Airplane 
Company  in  1982  in  preparation  for  the  Controlled  Impact  Demonstration  (CID)  [79],  This 
excellent  study  by  Widmayer  and  Brende  reviewed  publicly  available  and  company  data  and 
tabulated  detailed  information  from  153  “potentially  survivable”  accidents  drawn  from  an  initial 
database  of  583  accidents  occurring  from  1959  to  1979. 

While  fire  occurred  in  67%  of  the  report’s  cases  and  fatalities  due  to  fire  in  37%,  this  database 
does  not  represent  all  kinds  of  accidents,  only  those  during  the  selected  period  wherein  good  data 
could  be  derived  to  support  the  selection  of  crashworthiness  improvements  “or  that  demonstrated 
significant  crash  performance  of  the  structure.”  The  authors  of  this  report  are  unable,  during  the 
current  study,  to  obtain  the  same  depth  of  data  on  later  accidents  because  internal  company  data 
is  not  publicly  available,  we  have  provided  a  listing  of  selected  accidents  subsequent  to  1979  that 
support  the  findings  of  the  Boeing  study  (table  4-1)  and  show  that  the  problems  of  postcrash  fire 
have  not  been  solved. 
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TABLE  4-1 .  SELECTED  ACCIDENTS  WITH  FIRE,  SHOWING  IMPACT  AND  FIRE  DEATHS 
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Fire  Data 

Gear  tearout,  major  fire 

Destroyed  by  fire 

Cabin  flash  fire  60-90  sec  after  stopping 

Both  wings  damaged 

Wing  tanks  ruptured 

Major  destruction,  fire 

Major  destruction  of  wings 

Wing  struck  pole,  bldg,  ground 
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Eng.  Tom  off,  destroyed  by  fire 
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Rear  spar  crack  ruptured  tank 
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Small  fire  cargo  area,  smoke  in  cabin 

Major  fire,  unable  to  open  door 

Rt  wing  sep,  a/c  inverted 

Major  fire,  total  destruction 

Broke  up,  destroyed  by  fire 

Gear  collapse,  fuel  leak,  fire 

Fuel  lines  broke,  nacelle/fuselage  fire 

Wing  off,  fire  in  swampy  area 

Event 

Abort  T/O 

Gear  Up  Ldg 

In  Fit  Fire 

Takeoff  Coll,  Overrun 

Coll  Gnd,  Cont.  Rolled 

Landing,  Wx 

Ldg  Hard,  Slid  Into  Bldg 

T/0  Coll  Gnd,  Controlled 

T/O  Coll  Gnd  Uncontrolled 

Inflt  Fire,  Ldg  No  Hyd. 

Eng  Fail  On  T/O,  Overrun 

T/O  Improper  Config 

Landing,  Uncontrolled 

Gnd  Coll 

Coll/W  Commuter,  Landing 

T/O,  Uncontr.  Coll  Gnd 

Abort  T/O  Gear  Off 

Uncont  Eng,  Abort  T/O 

Abort  T/O,  Hard  Ldg 

Miss  Approach,  Cfit 

Uncont.  Eng,  Cut  Fuel  Line 

Prop  Fail  Off  Airport  Ldg 

Gear  Up  Ldg 

Collision  On  Landing 

Hard  Ldg,  Rmg  Collapse 

Cfit  On  Approach 

T/O  Coll  Gnd  Controlled 

Aft  Cg,  Settled,  Hard  Ldg 

Taxi  Coll,  Eng  Separation 

Overrun 
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NOTE:  The  last  two  columns  are  deaths  due  to  impact  and  fire. 


In  the  review  of  fire  hazards,  specifically  noted  were  the  breaking  of  fuselage  fuel  lines  to  aft 
engines  and  APUs,  wing/pylon  separation  due  to  ground  or  barrier  contact  and  inertial  loads,  and 
wing  fuel  tank  rupture.  Fire  was  present  in  103  accidents  and  fuel  spilled  without  fire  in  22 
accidents.  The  authors  of  the  Boeing  study  stated  that  the  greatest  potential  for  improved 
survivability  is  in  the  area  of  fire-related  fatalities. 

This  Boeing  report  contains  many  comments  and  recommendations  for  additional 
crashworthiness  research  and  development,  including  improvements  in  the  technology,  better 
data  collection  at  accident  sites  by  properly  trained  teams  of  crashworthiness  investigators, 
greater  use  and  improvement  in  computer  simulation  programs,  maintaining  and  updating  testing 
facilities,  additional  complete  aircraft  testing,  and  research  into  advanced  crashworthiness 
concepts.  It  is  significant  to  note  that  in  the  year  2000  there  are  no  properly  trained  teams  of 
crash  fire  investigators  for  civil  transport  accidents,  the  NASA  impact  test  facility  is  being 
considered  for  disassembly,  and  no  full-scale  crash  tests  of  transport  aircraft  have  been  done 
since  the  CID  in  1984. 

The  report’s  data  was  used  to  establish  a  range  of  crash  situations  that  could  provide  a  basis  for 
developing  improved  crashworthiness  design  technologies.  This  report  is  probably  still  the  best 
current  study  of  impact  scenarios  available  and  should  still  be  used  for  design  studies. 

In  addition  to  the  Boeing  study,  Lockheed  and  McDonnell  Douglas  were  also  contracted  for 
similar  work.  The  three  reports  are  summarized  in  a  joint  NASA/FAA  report  [54],  Thomson 
and  Caiafa  combined  the  databases  from  the  three  studies  and  established  candidate  accident 
scenarios  for  future  testing.  They  also  “...determined  that  the  most  critical  event  in  the  crash 
sequence  that  caused  most  fatalities  was  the  release  and  ignition  of  fuel  creating  a  fire  hazard.” 

Thomson  and  Caiafa  recommended  specific  research  areas  for  the  greatest  potential  reduction  in 
fire  fatalities  and  injuries.  They  are 

*  Fuel  Containment.  Increased  resistance  to  tears,  ruptures,  and  punctures.  Designing 
failure  points  on  wing  box  structures  with  double-wall  tanks  at  these  points.  Reduction 
of  the  potential  for  tank  explosion  using  flame  arrestor  media.  Designing  fuel 
transfer/feed  lines  more  resistant  to  failure  and  automatic  shutoff  of  fuel  flow. 

*  Tank  Rupture.  Effects  of  main  gear  collapse  on  tank,  including  wing  contact  with  ground 
tearing  lower  surface.  Engine  separation  and  tumbling  under  wing  causing  penetration. 
Fuel  spill  and  electrical  arcs  at  engine/pylon  separation. 

*  Fuel  Characteristics.  Antimisting  fuels  and  gelled  fuels  research  to  continue. 


An  additional  area  they  covered  was  floor  disruption  causing  increased  trauma  injuries.  This  can 
be  caused  by  auxiliary  fuel  tanks  in  the  cargo  compartment  delivering  impact  loads  from  the 
lower  skin  directly  to  the  floor  beams.  This  has  been  noted  in  test  drops  (section  3)  and  is  an 
area  of  concern  in  the  design  of  range  extension  fuel  storage. 

None  of  the  above  areas  have  been  addressed  by  regulatory  changes  to  14  CFR  Part  25. 
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Frank  Taylor  of  the  Cranfield  Aviation  Safety  Centre  in  the  UK  has  studied  the  transport  fire 
problem  for  many  years  and  has  produced  many  excellent  reports  on  the  subject  (see  references 
80,  81,82,  and  83). 

Mr.  Taylor’s  data  indicates  that,  worldwide  in  the  mid-1990s,  there  were  approximately  600 
people  killed  annually  in  survivable  accidents  and  about  800  in  nonsurvivable  accidents.  Earlier 
data  had  indicated  that  about  45  percent  of  the  fatalities  in  survivable  accidents  were  due  to  fire, 
but  the  most  recent  study  reported  that  cause  of  death  data  was  available  in  too  few  accidents  to 
make  any  accurate  estimate  of  fire  deaths.  He  also  points  out  in  his  conclusions  in  reference  82 
that  “The  overall  safety  record  is  sufficiently  good  to  make  it  very  unlikely  that  any  particular 
safety  feature  will  appear  to  be  cost-effective.  Consequently,  if  progress  is  to  be  made,  a  new 
way  is  needed  of  dealing  with  such  safety  features.”  “Emphasis  should  be  placed  on  minimizing 
the  disbenefits  of  potential  safety  features  in  order  to  optimize  the  net  benefit.” 

Mr.  Taylor  has  also  suggested  some  recommended  action  areas  for  postcrash  fire  prevention. 
Among  them  are: 

•  External  camera(s)  and  cockpit  monitor 

•  Cabin  water  mist  system 

•  Less  flammable  fuels 

•  Passenger  smoke  hoods 

•  Fuel  tank  and  fuselage  integrity  following  undercarriage  collapse,  etc. 

•  Greater  protection  of  fuel/hydraulic  lines  passing  through  the  fuselage 

•  Onboard  extinguishing  systems  in  equipment  bays 

4.3  SPECIFIC  ACCIDENTS. 

In  1985,  a  British  B-737  in  the  U.K.  was  involved  in  a  fire  during  the  takeoff  roll  when  an  engine 
failure  led  to  a  rupture  of  a  fuel  tank  access  cover.  A  large  fire  began  before  the  aircraft  came  to 
a  halt.  All  injuries  and  fatalities  were  due  to  fire.  The  British  report  of  this  accident  contains 
many  recommendations  regarding  the  minimization  of  fire  hazards,  and  this  led  to  many  changes 
in  the  standards  for  interior  materials  and  improved  tank  cover  plate  requirements. 

The  following  recommendations  were  made  in  that  report  that  relate  to  this  study.  (There  were 
other  recommendations  regarding  firefighting,  etc.,  that  are  not  included  herein.) 

4.2  Research  should  be  undertaken  into  methods  of  providing  the  flight  deck 
crew  with  an  external  view  of  the  aircraft,  enabling  them  to  assess  the 
nature  and  extent  of  external  damage  and  fires. 

4.5  Emergency  equipment  for  use  by  cabin  crew  during  an  emergency 
evacuation  should  be  stowed  at  the  cabin  crew  stations. 

4.10  A  review  of  the  approval  of  the  cabin  configuration  as  it  existed  on 
G-BGJL  should  be  conducted,  with  particular  reference  to  the  following 
features  of  that  configuration: 
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i)  The  restricted  view  of  the  passenger  cabin  afforded  the  forward 
cabin  crew  when  seated. 

ii)  The  forward  aisle  restriction  created  by  the  floor  to  ceiling  forward 
galleys. 

iii)  Access  to  the  overwing  exit  where  the  presence  of  row  10  seats 
appeared  to  conflict  with  the  British  Civil  Airworthiness 
Requirements.  It  is  recommended  that  all  row  10  seats  be  removed. 

The  approval  of  other  configurations  on  Boeing  737  and  other  types  should  also  be 

reviewed  with  the  intention  of  addressing  any  similar  problems. 

4.1 1  A  review  should  be  conducted  to  examine  the  adequacy  of  existing  British 
Civil  Airworthiness  Requirements  relating  to  'unobstructed  access’  to  exits 
and  these  updated  where  necessary  to  take  account  of  modem  high  density 
seating  configurations. 

4.18  A  thorough  review  should  be  undertaken  into  techniques  for  extinguishing 
fires  inside  the  passenger  cabins  of  public  transport  aircraft,  with  a  view  to 
rectifying  the  current  deficiencies  in  airfield  firefighting  capability  when 
dealing  with  internal  fires. 

4.19  Onboard  water  spray/mist  fire  extinguishing  systems  having  the  capability 
of  operating  both  from  on-board  water  and  from  tender-fed  water  should 
be  developed  as  a  matter  of  urgency  and  introduced  at  the  earliest 
opportunity  on  all  commercial  passenger  carrying  aircraft. 

4.20  The  balance  of  effort  in  aircraft  fire  research  should  be  restored  by 
increased  effort  directed  towards  fire  hardening  of  the  hull,  the  limitation 
of  fire  transmission  through  the  structure  and  the  prevention  of  structural 
collapse  in  critical  areas.  Short  term  measures  should  be  devised  for 
application  to  existing  types  but,  in  the  long  term,  fire  criteria  should  form 
a  part  of  international  airworthiness  requirements. 

4.21  A  requirement  should  be  introduced  to  ensure  that  existing  external  fuel 
tank  access  panels  which  are  vulnerable  to  impact  from  engine  or 
wheel/tire  failures  on  aircraft  in  service  are  at  least  as  impact  resistant  as 
the  surrounding  structure.  The  potential  risk  of  damage  from  debris 
impacts  should  be  addressed  in  future  by  appropriate  design  requirements 
covering  debris  ejection  from  engines  and/or  impact  strength  requirements 
for  the  airframe. 

4.24  The  Civil  Aviation  Authority  should  urgently  give  consideration  to  the 
formulation  of  a  requirement  for  the  provision  of  smokehoods/masks  to 
afford  passengers  an  effective  level  of  protection  during  fires  which 
produce  a  toxic  environment  within  the  aircraft  cabin. 
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4.25  The  proposed  requirement  for  cabin  crew  smokehood  protection  be 
extended  to  include  training  for  crew  donning  and  use  during  aircraft 
emergency  evacuations  associated  with  a  fire  and/or  smoke  threat  during 
the  evacuation. 

4.26  The  applicable  regulatory  requirements  for  aircraft  cabin  materials 
certification  should  be  amended  at  the  earliest  opportunity  to  include  strict 
limitations  of  smoke  and  toxic/irritant  gas  emissions. 

4.27  A  research  program  should  be  undertaken  to  establish  the  effect  of  water 
mist/spray  extinguishing  systems  on  the  toxic/irritant  constituents  of  fire 
atmospheres. 

4.28  The  existing  regulatory  requirements  governing  the  Evacuation 
Certification  of  public  transport  aircraft  should  be  reviewed  and  amended 
to  include: 

A  demonstration  of  an  acceptable  evacuation  time  when  the  cabin  is 
evacuated  using  half  the  total  number  of  exits,  disposed  towards  one 
end  of  the  cabin;  that  end  being  chosen  which  represents  the  greatest 
restriction  to  passenger  egress. 

Simulation  of  a  defined  dense  smoke  atmosphere  within  the  cabin, 
existent  from  the  initiation  of  the  evacuation  until  its  completion. 

All  other  sub-testing  associated  with  cabin  evacuation,  including 
passenger  aisle  flow,  the  identification  of  exits  and  aperture  egress 
rates,  upon  which  design  and  configuration  certification  decisions 
are  based,  be  conducted  in  the  same  simulated  smoke  atmosphere. 

In  the  15  years  since  this  accident,  only  a  few  of  these  items  have  been  adequately  addressed. 

Recent  accidents  with  fire  significance: 

•  Kegworth,  Leicestershire,  U.K.,  B737-400,  Jan.  8,  1989 

The  aircraft  was  flown  into  the  ground  with  both  engines  off.  The  fuselage  broke  into 
three  sections,  with  the  nose  section  going  up  an  embankment.  The  center  section,  with 
wings,  remained  upright.  The  aft  section  broke  off  aft  of  the  wing  trailing  edge  and 
buckled  to  the  right.  All  the  landing  gear  broke  off  at  their  design  separation  points;  both 
engine  pylons  separated  at  points  different  than  their  design  points;  and  wing  leading 
edges  were  damaged  by  trees.  No  fuel  tanks  were  ruptured.  A  fire  occurred  at  the  left 
engine  and  was  burning  after  impact.  It  began  to  flare  up  just  as  fire  fighters  arrived  and 
extinguished  it.  There  was  a  very  rapid  response  due  to  early  notification  of  the 
impending  emergency.  Of  the  126  persons  onboard,  47  died  of  impact  injuries.  Many 
more  were  trapped  and  injured  and  would  have  died  had  there  been  a  significant 
postimpact  fire. 


i) 

ii) 

iii) 
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Carrollton,  GA,  Atlantic  Southeast  Airlines,  EMB-120RT,  August  21,  1995 

The  loss  of  a  propeller  blade  in  flight  resulted  in  a  forced  landing  off  airport.  The  aircraft 
broke  up,  3  of  the  4  wing  fuel  tanks  were  ruptured  and  a  severe  fire  began  about  1  minute 
after  the  aircraft  came  to  a  stop.  Electrical  arcing  sounds  were  heard  by  the  survivors. 
The  fire  involved  the  forward  cabin,  killing  seven  passengers  and  the  captain.  The  first 
officer  tried  to  hack  open  his  side  window  with  a  fire  axe  but  was  unable  to  do  so,  and  the 
wooden  axe  handle  was  broken  during  the  attempt.  He  was  rescued  by  crash/fire/rescue 
personnel  after  the  cabin  fire  was  extinguished. 

Some  passengers  reported  their  clothes  were  saturated  with  fuel.  There  was  no  analysis 
of  how  this  occurred,  or  of  any  fuel  lines  that  may  have  been  broken  in  the  cabin  or 
center  wing  area. 

The  only  recommendation  regarding  fire  issues  was  to  study  the  function  of  the  fire  axe 
and  provide  a  Technical  Standard  Order  (TSO)  as  necessary. 

East  Grandby,  CT,  American  Airlines,  MD-83,  November  12,  1995 


This  aircraft  hit  trees  on  a  ridge  prior  to  landing  short  in  the  localizer  antenna  area, 
ending  up  on  the  runway.  There  was  no  fire  damage  to  the  fuselage  but  some  minor  fire 
evidence  in  the  right  engine.  No  fuel  leaks  were  reported  but  hydraulic  lines  in  the 
landing  gear  area  were  broken.  There  was  no  analysis  of  how  severe  these  leaks  were  or 
why  there  was  no  fire. 

LaGuardia  Airport,  NY,  Delta  Air  Lines,  MD-88,  October  19,  1996 


This  aircraft  landed  short  in  the  approach  light  area,  the  main  landing  gear  separated  and 
it  skidded  along  the  runway.  A  fuel  leak  was  noted  due  to  a  puncture  in  the  right  wing 
tank,  causing  the  loss  of  about  600  gallons  of  fuel.  There  was  no  fire.  There  was  no 
analysis  of  why  there  was  no  fire  nor  of  hydraulic  leaks  associated  with  the  loss  of  the 
landing  gear. 

Quincy,  IL,  United  Express  Airlines,  Beech  1900C  and  Beech  A90  collision  on  runway 
Nov.  19,  1996 

In  this  accident,  the  impact  forces  were  at  a  survivable  level  and  all  persons  onboard  both 
aircraft  were  killed  by  the  fire  which  began  immediately  upon  contact.  There  was  no 
firefighting  staff  at  the  airport  at  the  time  of  the  accident,  but  rescue  attempts  began 
almost  immediately.  The  airstair  door  of  the  1900  was  jammed  so  that  witnesses  who 
arrived  at  the  aircraft  while  the  pilot  was  still  alive  could  not  open  it.  There  are 
recommendations  in  the  report  regarding  door  jamming  and  airport  firefighting 
capabilities,  but  nothing  on  fire  prevention  or  crashworthiness. 
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Newark,  NJ,  Federal  Express,  MD-11,  July  31,  1997 


This  aircraft  experienced  a  hard  landing,  causing  the  right  main  landing  gear  to  fail 
upwards,  fracturing  the  right  wing.  Fire  evidence  began  along  the  runway  about  2000 
feet  from  the  wreckage.  The  aircraft  rolled  almost  inverted  after  the  wing  failure.  All 
three  engines  were  separated  from  the  airframe,  but  no  details  are  provided  as  to  where  or 
how  any  fuel  and  hydraulic  lines  separated  or  released  fluid. 

The  fire  section  of  the  report  states,  in  its  entirety 

“A  fuel- fed  fire  erupted  on  impact.” 

The  crash/fire/rescue  crew  reported  that  as  they  approached  the  aircraft  flames  were 
venting  from  the  aft  section  of  the  fuselage.  There  is  no  information  as  to  the  source  of 
fuel  in  that  area.  Although  the  right  wing  tank  was  compromised  and  may  have  provided 
most  of  the  fuel  for  the  fire,  the  line  to  the  aft  engine  and  auxiliary  power  unit  (APU)  also 
was  broken  but  no  details  are  provided  that  would  help  locate  a  self-sealing  fitting  in  an 
appropriate  location. 

There  were  no  recommendations  regarding  fire  safety  in  this  report. 

•  Guam,  Korean  Air,  B-747,  August  6,  1997 

In  this  accident,  a  Controlled  Flight  Into  Terrain  (CFIT)  accident,  there  were  26  survivors 
of  the  254  persons  onboard.  The  report  (NTSB/AAR-00/01)  does  not  give  the  cause  of 
death  information  needed  to  separate  the  trauma  deaths  from  thermal  deaths,  but  the 
impact  into  a  hill  severely  damaged  the  aircraft,  probably  rupturing  all  fuel  tanks,  and 
there  was  a  large  fire.  Some  survivors  were  burned,  and  one  reported  that  a  “ball  of 
flame  was  going  down  the  center  of  the  airplane”  and  that  passengers  were  screaming  and 
calling  for  help  (NTSB  report,  page  45).  There  were  no  recommendations  in  this  report 
regarding  fire  protection  or  prevention. 

•  Miami,  FL,  Fine  Airlines,  DC-8-61,  August  7,  1997 

This  aircraft  was  out  of  trim  on  takeoff  and  had  an  uncontrolled  impact  with  the  terrain 
beyond  the  end  of  the  runway.  All  four  engines  struck  the  ground  and  separated  from  the 
pylons,  but  no  details  are  provided  as  to  fluid  line  separations.  The  airframe  was 
extensively  damaged  and  much  was  consumed  by  fire. 

The  fire  section  of  the  report  states,  in  its  entirety 

“A  fuel-fed  fire  erupted  on  impact.” 
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•  Little  Rock,  AR,  American  Airlines,  MD-82,  June  1,  1999 

In  this  overrun  accident,  the  aircraft  departed  the  end  of  the  runway  and  impacted  the 
approach  light  structures  while  going  down  a  rocky  berm  to  the  river  level,  separating  the 
fuselage  into  three  sections  and  driving  metal  bars  into  the  fuselage  in  several  places. 
The  left  side  of  the  first  class  section  was  tom  off  and  the  seats  on  that  side  were  ejected. 
There  were  11  fatalities  (six  from  trauma  and  five  from  fire)  among  the  145  persons 
onboard.  Fire  broke  out  over  the  center  section  tank  where  the  fuselage  had  separated, 
and  survivors  exited  both  forward  and  aft  of  that  point.  Fire  ultimately  consumed  the 
upper  fuselage  aft  of  the  wing  leading  edge.  The  left  wing  was  severely  damaged  and 
separated  near  the  root  and  near  the  tip.  The  center  section  tank  was  tom  open  and  all  the 
fuel  drained  out,  but  the  right  wing  retained  its  1000  gallons  of  fuel.  The  structures  report 
does  not  discuss  the  fuel  lines  in  the  fuselage  leading  to  the  aft  engines.  A  final  report  of 
this  accident  has  not  yet  been  issued,  so  there  are  no  detailed  conclusions  or 
recommendations  regarding  fire  in  this  accident. 

In  all  of  the  above  reports,  there  is  not  enough  data  to  determine  whether  the  installation  of 
frangible  self-sealing  fittings  would  have  made  a  difference  in  the  fire  situation.  There  is  not 
enough  data  on  fuel  tank  failures  to  give  designers  information  on  how  those  failures  might  be 
prevented.  There  is  no  mention  of  auxiliary  fuel  tanks,  whether  they  were  installed  or  not,  and  if 
installed,  whether  they  contributed  to  the  fire. 

The  recommendations  of  the  SAFER  committee  (1980)  and  the  Boeing  study  (1982)  for  better 
accident  investigation  data  have  not  been  followed.  The  NTSB  has  not  made  any  significant 
recommendations  on  fire  prevention  in  the  above  accidents.  While  survival  factors  get  attention, 
and  have  their  own  section  in  the  NTSB  investigation,  fire  prevention  and  detailed  fire  analysis 
do  not. 
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5.  CURRENT  FUEL  SYSTEMS. 

5.1  AIRFRAME  DESIGN  CATEGORIES. 

Transport  aircraft  certified  under  14  CFR  Part  25  include  all  aircraft  over  12,500  lbs  plus  jet- 
powered  aircraft  of  any  weight.  Many  aircraft  models  operate  at  a  variety  of  weights  and  fuel 
tank  configurations,  depending  on  specific  model,  so  there  may  be  some  overlap  in  the  following 
subdivisions  which  are  established  for  use  in  this  report: 


Description 


A  Under  60,000  #,  all  engines  on  the  wings 

A.l  High  wing,  all  engines  on  the  wings  (ex.  DHC7  and  8) 

A.2  Low  wing,  all  engines  on  the  wings  (ex.  BE1900) 

A.3  Low  wing,  engines  on  aft  fuselage  (ex.  Bombardier  CL600) 


B  61,000  to  100,000# 

B.l  High  wing,  all  engines  on  the  wings  (ex.  BA146) 

B.2  Low  wing,  all  engines  on  the  wings 

B.3  Low  wing,  engines  on  aft  fuselage  (ex.  ERJ145,  F28) 


C  Over  100,000#,  all  low  wing 

C.l  All  engines  on  wing  (ex.  B737,  B747,  B777) 

C.2  All  engines  on  aft  fuselage  (ex.  MD81,  B717,  B727) 

C.3  Engines  on  wing  and  aft  fuselage/tail  (ex.  L101 1,  MD1 1) 

Table  5-1  lists  many,  but  not  all,  current  aircraft  with  their  approximate  takeoff  gross  weight, 
type  of  engine,  wing  configuration,  location  of  manufacturing.  It  must  be  noted  that  this  is  a 
time  of  rapid  expansion  of  air  carrier  fleets,  especially  in  the  regional  markets.  New  and 
derivative  aircraft  are  being  announced  almost  monthly.  Some  aircraft  models  are  being 
stretched  with  attendant  gross  weight  increases,  so  that  the  classes  outlined  herein  are  very 
arbitrary  and  some  aircraft  types  may  overlap  categories. 


5.2  FUEL  SYSTEM  DESIGNS. 

In  a  study  prepared  in  1982  for  the  AMK  program,  commercial  aircraft  fuel  systems  were 
reviewed  for  potential  component  problems  using  gelled  fuels.  This  report  [84]  contains  detailed 
diagrams  of  many  typical  (basic)  fuel  systems,  including  line  sizes,  types  and  locations  of 
pumps,  check  valves,  and  vent  and  scavenge  systems. 

Detailed  data  of  this  type  will  not  be  repeated  herein,  as  systems  can  vary  even  within  specific 
models  of  aircraft  depending  on  customer  configurations,  engine  choices,  and  addition  of 
auxiliary  tanks.  However,  the  basic  concepts  of  fuel  storage  and  distribution  are  similar  in  all 
aircraft. 
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TABLE  5-1.  CURRENT  AIRCRAFT 


Aircraft 


Max  Weight 


EMB110 _ 

D228-212 

J31 _ 

BE1900D _ 

SH33Q _ 

NORD262A _ 

SA227-III _ 

EMB120ER _ 

SH36Q-3QO _ 

S340B 

D328 _ 

ATR42-500 

DHC7 _ 

EMB145ER _ 

FOKKER  50 

HS748-2A _ 

ATR72-212 _ 

SA2000 

ATP 

CRJ200 _ 

DHC8Q400 _ 

F28-4000 _ 

CRJ700 _ 

BAE 146-200 _ 

F28-0 1 OO/FOKKER  100 

B737-200 _ 

B7 17-200 _ 

A3 18 

MD82 _ 

B737-700 _ 

DC9-88 _ 

A3  20/3 19/321 _ 

B737-800 _ 

B727-200 _ 

B757-200 _ 

B720 _ 

B707 

A3 1 0 _ 

DC8-63 

A300 _ _ 

B767-300 _ 

CONCORDE _ 

A330 _ 

L101 1-500 _ 

A340 _ 

DC  10-30 

!  MDll _ 

B777-300 

B747-200 

B747-400 


12500 

14110 

15212 

16950 

22000 

23490 

24500 

26600 

27000 

28800 

30842 

41005 

44000 

45414 

45900 

46500 

49603 

50260 

50550 

51000 

63750 

75240 

82500 

93000 

101500 

117000 

121000 

145200 

149500 

153000 

160000 

169000 

172500 

209500 

220000 

234000 

335000 

346125 

355000 

370000 

380000 

408000 

467000 

510000 

553360 

580000 

625000 

660000 

805000 

875000 


Engine 

TP 

TP 

TP 

TP 

TP 

TP 

TP 

TP 

TP 

TP 

TP 

TP 

TP 

J 

TP 

TP 

TP 

TP 

J 

J 

TP 

J 

J 

J 

J 

J 

J 

J 

J 

J 

J 

J 

_ 

_J _ 

__J _ 

_ 

J 

_J _ 

_ 

_J _ 

_J _ 

_ 

_J _ 

__J _ 

_ 

_J _ 

__J _ 

_ 

_J _ 

J 


Wing 

L 

H 

L 

L 

H 

H 

L 

L 

H 

L 

H 

H 

H 

L 

H 

L 

H 

L 

H 

L 

H 

L 

L 

H 

L 

L 

L 

L 

L 

L 

L 

L 

L 

L 

L 

L 

_L _ 

_L _ 

_L _ 

L 

_L _ 

L 

_L _ 

_L _ 

_L _ 

_L _ 

_L _ 

_L _ 

L 

L 


ENGINE  WING  MFG 

TP  =  Turbo  Prop  H  =  High  B  =  Brazil 

J  ~  -1^  M  =  Mid  C  =  Canada 

L  =  Low  E  =  Europe 


mm 


In  general,  aircraft  of  all  the  above  types  carry  fuel  in  wing  tanks,  usually  integral  to  the 
structure.  (See  figures  5-1,  5-2,  and  5-3  for  examples  of  integral  wing  tank  spaces  which  have 
been  cut  open  during  the  process  of  scrapping  the  airframe.)  In  addition,  center  tanks  are  used  in 
low-wing  aircraft  in  many  cases.  Some  of  these  are  integral  (see  figure  5-4  for  the  aft  half  of  a 
large  aircraft  center  tank  that  has  been  cut  open  and  figure  5-5  for  another  view  of  a  center  tank 
and  wing  root  fuel  spaces)  and  some  have  bladder  liners  (see  figure  5-6  for  a  view  of  a  center 
tank  with  openings  to  the  bladders,  figure  5-7  for  a  view  inside  the  bladder  compartment,  and 
figure  5-8  showing  the  aft  compartment  with  a  tom  bladder).  Some  high-wing  aircraft  carry  fuel 
in  fuselage  tanks  over  the  passenger  compartment,  rather  than  in  the  wings.  Figure  5-9  shows 
this  type  of  tank  after  a  drop  test  at  the  FAA  test  center.  The  tanks  have  moved  downward  into 
the  passenger  space  and  both  the  forward  and  aft  tanks  leaked  heavily  after  a  vertical  impact 
which  was  otherwise  survivable.  Figure  5-10  shows  the  bottom  of  the  aft  tank  with  all  fuel 
fittings  broken.  (This  test  is  discussed  in  section  3.1.) 

In  addition  to  the  above  configurations,  many  aircraft  have  additional  tank  capacity  in  the  form 
of  fuselage  tanks  in  the  forward  and/or  aft  lower  baggage  areas  or  in  the  main  cabin  area  in  some 
cargo  and  mixed  configurations.  Most  of  these  are  removable  auxiliary  tanks.  Figure  5-11 
shows  a  typical  underfloor  auxiliary  tank  as  installed  for  a  test  at  the  FAA  test  center.  It  is 
suspended  from  the  main  cabin  floor  and  restrained  at  the  bottom  from  fore/aft  movement.  It  is 
removable  when  necessary.  This  tank  leaked  fuel  after  a  drop  test  representing  a  survivable 
accident  (see  section  3.1).  Some  aircraft  may  carry  as  many  as  five  auxiliary  tanks  in  various 
locations. 

In  some  later  model  large  aircraft  (Category  C),  fuel  is  stored  in  integral  tanks  in  the  horizontal 
tailplane.  This  provides  additional  fuel  capacity  and  the  ability  to  adjust  the  center  of  gravity  for 
lower  trim  drag  during  cruise. 

Fuel  distribution  systems  for  aircraft  with  all  engines  on  the  wings  have  little  or  no  fuel  plumbing 
in  the  fuselage  except  for  the  center  of  the  wing  area.  In  some  aircraft  with  a  dry  center  bay  area, 
there  are  large  fuel  lines  through  this  area  between  the  wings.  There  may  be  a  line  to  an 
auxiliary  power  unit  (APU)  in  some  other  part  of  the  aircraft,  such  as  the  tail  or  landing  gear 
well.  There  may  also  be  a  pressure  refueling  line  located  somewhere  lower  in  the  fuselage  for 
high-wing  aircraft.  Aircraft  with  engines  on  the  aft  fuselage  or  in  the  tail  (Categories  A.3,  B.3, 
C.2,  and  C.3)  all  have  fuel  lines  that  typically  are  routed  under  the  floor  of  the  main  cabin  from 
the  wing  area  to  the  aft  fuselage.  These  lines  can  be  several  inches  in  diameter  and  contain 
considerable  quantities  of  fuel  at  all  times.  Lines  in  the  pressurized  area  are  shrouded  and  the 
shrouds  are  drained  to  a  safe  area.  See  figure  5-12  for  an  example  of  two  shrouded  fuel  lines 
coming  out  from  below  the  main  cabin  floor  in  the  tail  cone  and  routing  to  two  aft-mounted 
engines. 
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FIGURE  5-3.  WING  TANK  CUT  OPEN 


FIGURE  5-8.  CUT  OPEN  CENTER  SECTION  BLADDER  TANK  SHOWING 

SUPPORT  LACING 


FIGURE  5-9.  FUSELAGE  FUEL  TANKS  OVER  PASSENGER  COMPARTMENT 

AFTER  DROP  TEST 


FIGURE  5-10.  BOTTOM  VIEW  OF  FUSELAGE  TANK  (FROM  FIGURE  5-9)  SHOWING 

FOUR  FUEL  FITTINGS  TORN  FROM  TANK 


FIGURE  5-11.  AUXILIARY  FUEL  TANK  IN  BAGGAGE  AREA  UNDER  CABIN 

FLOOR  PRIOR  TO  DROP  TEST 


These  two  fuel  lines  are  routed  aft  through  the  fuselage  through  holes  in  the  floor  beams  of  this 
aircraft.  If  the  floor  is  disrupted,  the  lines  will  likely  break  because  they  cannot  displace  and 
stretch.  In  another  transport  airplane  design,  the  lines  are  suspended  below  the  floor  beams.  The 
designer  of  that  system  reports  that  the  lines  were  tested  by  forcing  them  transversely  all  the  way 
across  the  aircraft  by  a  ram.  They  stretched  and  necked  down,  but  did  not  leak. 

Self-sealing  breakaway  valves  are  rarely  used  in  transport  aircraft  although  they  have  been 
available  for  40  years.  The  valves  are  sometimes  used  in  auxiliary  fuel  systems,  such  as  fuselage 
tanks.  However,  this  research  effort  could  not  find  any  instances  where  they  are  (or  were) 
installed  in  primary  fuel  systems,  even  in  areas  of  known  separation  such  as  designed  overload 
disconnection  points  in  engine  pylons. 
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FIGURE  5-12.  SHROUDED  FUEL  LINES  FROM  UNDER  CABIN  FLOOR 

INTO  AFT  FUSELAGE 

Authors  of  the  1988  FAA  report  to  Congress  included  the  following  statement  as  their  principal 
argument  against  employing  self-sealing  breakaway  valves  in  airplanes’  primary  fuel  systems: 

It  may  be  noted  that  breakaway  fittings  are  used  in  the  fuselage  auxiliary  fuel 
system  installations  of  some  current  narrow-body  transport  airplanes,  but  were 
removed  from  an  installation  in  a  wide-body  airplane  after  a  fitting  closed 
inadvertently  on  the  ground  due  to  fuel  system  structural  deflections.  [52] 
(underline  added) 
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The  underlined  portion  of  the  statement  is  false.  This  easily  verifiable  misinformation  has  been 
accepted  uncritically  for  many  years.  Recent  discussions  with  the  fuel  system  engineer  actually 
involved  in  the  test  revealed  that,  in  fact,  the  fuel  line  which  was  to  have  been  connected  to  the 
valve  was  too  short,  and  the  mechanic  installing  it  stretched  it  attempting  to  force  the  installation. 
The  valve  broke  due  to  excessive  tension  on  the  overloaded  line.  Management  then  decreed  that 
the  valve  be  removed  rather  than  take  the  time  to  redesign  its  installation  properly. 

NPRM  85-7A  proposed  revising  standards  for  Crash-Resistant  Fuel  Systems  in  14  CFR  Part  23 
airplanes.  An  aircraft  engineering  consultant— an  FAA-Designated  Engineering  Representative 
(DER) — submitted  comments  in  a  letter  dated  Oct.  17,  1989,  stating  he  had  “...completed  a 
study  of  the  failure  probability  of  the  breakaway  valves  used  on  the  U.S.  Army’s  UH-1  series 
helicopter.  It  was  determined  that  the  average  failure  rate  of  these  components  was  2.17  x  10'  .” 
This  misrepresentation  was  originally  created  for  use  in  general  aviation  product  liability 
litigation  involving  crashworthiness  issues.  It  was  derived  from  U.S.  Army  spare  parts  order 
data,  which  the  commenter  alleged  to  be  replacements  for  failed  items,  and  not  from  any 
reported  failure  data.  In  fact,  no  U.S.  Army  accident  has  ever  been  traced  to  inadvertent  closure 
of  a  breakaway  valve. 

False  allegations,  such  as  these  two  examples,  could  easily  have  been  refuted  by  minimal 
research.  Instead,  they  were  uncritically  accepted  as  facts  and  included  in  official  documents, 
fueling  fears  of  unreliability  which  have  been  used  to  oppose  consideration  of  the  valves’  use  in 
primary  fuel  systems.  Indeed,  there  has  never  been  a  significant  problem  documented  from 
using  properly  installed  breakaway  valves  in  U.S.  Army  or  transport  aircraft. 

Typical  fuel  usage  patterns  are  to  keep  fuel  in  the  inner  part  of  the  wings  as  long  as  possible  in 
order  to  reduce  wing  bending  moments.  In  some  cases  fuel  is  moved  forward  or  aft  to  adjust 
center  of  gravity  for  cruise  efficiency  purposes.  Auxiliary  tanks  are  usually  pumped  into  main 
tanks  after  some  main  tank  fuel  is  used.  Accidents  occurring  on  or  shortly  after  takeoff  often 
have  fuel  in  all  tanks,  while  accidents  occurring  on  landing  may  have  many  empty  or  nearly 
empty  tanks,  some  holding  hazardous  quantities  of  fuel  vapor.  Wing  tanks  will  always  have  fuel 
in  them  on  landing  (except  for  fuel  exhaustion  accidents)  and  will  often  be  the  source  of  spilled 
fuel.  Some  operators  carry  extra  fuel  to  avoid  refueling  at  locations  where  fuel  is  short  or  very 
expensive,  so  some  landing  accidents  may  occur  with  much  higher  quantities  of  fuel  than  others. 

Aircraft  in  Category  A  have  thinner  skins  in  the  wings  than  larger  aircraft  and,  thus,  are  more 
likely  to  be  damaged  on  impact.  Some  of  these  aircraft  also  have  bladders  in  some  tanks, 
depending  on  location  in  the  aircraft.  To  the  knowledge  of  the  authors  of  this  report,  there  are  no 
cases  in  which  the  bladders  are  of  a  crash-resistant  qualified  material,  rather,  they  are  only  liquid 
barriers  of  the  thinnest  usable  material.  Some  of  these  aircraft  are  high-wing  types,  reducing  the 
likelihood  of  engine  tear-off  or  wing  drag,  although  in  one  FAA  drop  test  an  engine  broke  off 
and  the  wings  broke  downward  at  survivable  impact  levels.  Some  high- wing  aircraft  have 
pressure  refueling  connections  on  the  landing  gear  fairing. 

Aircraft  in  Category  B  have  stronger  wing  skins  than  Category  A  aircraft,  but  also  carry  larger 
amounts  of  fuel  in  the  wings.  As  wing  design  becomes  more  complex,  for  example,  with 
leading-  and  trailing-edge  lift  devices,  the  simple  box  structure  of  the  wing  tank  space  is  made 
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more  complicated.  For  example.  Figure  5-13  shows  boxlike  structures  from  a  wing- forward  spar 
web  back  into  the  fuel  space  to  permit  the  leading-edge  devices  to  retract  into  the  fuel  storage 
area.  Figure  5-14  shows  the  same  area  from  the  front  of  the  wing  spar.  This  complex  structure 
increases  the  likelihood  of  compromising  the  tank  during  accidents  if  the  leading-edge  devices 
are  pushed  back  into  the  wing  irregularly. 


P 


FIGURE  5-13.  POCKET  INTO  FORWARD  WALL  OF  WING  TANK  TO  ALLOW 
LEADING-EDGE  DEVICE  RETRACTION 


FIGURE  5-14.  LEADING-EDGE  DEVICE  RETRACTING  INTO  POCKET  IN 

WING  FUEL  TANK 


Category  C  aircraft  have  the  strongest  skins  and  wing  structure  and,  therefore,  are  more  likely  to 
remain  intact  during  survivable  accidents,  but  in  partially  survivable  crashes,  they  also  have  the 
most  fuel  and  are  likely  to  have  the  most  passengers,  making  the  risks  of  postcrash  fire  more 
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significant.  The  use  of  tailplane  fuel  tanks  in  this  category  also  provides  the  potential  of 
spraying  fuel  down  on  the  wreckage  during  the  accident  sequence  if  the  horizontal  tail  is 
impacted  or  over-stressed  during  the  event.  Some  of  these  aircraft  have  a  dry  center  wing 
section  with  fuel  lines  crossing  between  the  wings. 

One  of  the  many  important  aspects  of  preventing  fuel  leaks  in  survivable  accidents  is  to  prevent 
fuel  leakage  when  the  landing  gear  is  tom  off  during  the  impact  sequence.  This  has  happened 
often  in  the  past  [79].  Many  times  fires  have  occurred,  even  though  14  CFR  Part  25.721  requires 
that  gear  failure  not  release  hazardous  quantities  of  fuel.  In  addition,  14  CFR  Part  25.994 
requires  protection  of  the  fuel  system  in  wheels-up  landings. 

Most  transport  aircraft  use  pressure-feed  systems  where  pumps  in  the  tanks  deliver  fuel  to  the 
engines  under  pressure.  This  is  especially  common  in  low-wing  aircraft.  Some  systems  use 
suction-feed  and/or  gravity-feed  systems.  This  means  that,  in  most  accident  situations,  there  will 
be  pressurized  fuel  lines  in  various  locations  in  the  aircraft.  It  also  requires  wiring  to  the  pumps, 
which  is  often  routed  through  sealed  plumbing  lines  within  the  tank.  Figure  5-15  shows  the 
routing  of  fuel  pump  wiring  inside  an  integral  tank  and  figure  5-16  shows  the  same  area  on  the 
other  side  of  the  tank  wall.  Figure  5-17  is  a  pump  in  an  integral  wing  tank.  Since  the  pumps 
need  to  be  on  the  bottom  of  the  tanks,  they  are  in  vulnerable  locations  for  impact  with  the 
ground.  (See  figure  5-18  for  a  pump  compartment,  and  figure  5-19  for  a  lower  wing  surface  with 
openings  for  pumps  and  access  ports.) 

Fuel  quantity  measuring  systems  are  always  needed,  and  some  systems  use  exposed  wiring 
inside  the  tanks  (see  figure  5-20). 


FIGURE  5-18.  ACCESS  FROM  WING  LOWER  SURFACE  TO  FUEL  PUMP  CAVITY 


FIGURE  5-19.  WING  LOWER  SURFACE  WITH  PUMP  OPENINGS  AND 

ACCESS  OPENINGS 


FIGURE  5-20.  FUEL  QUANTITY  SENSOR  AND  WIRING  INSIDE  WING  FUEL  TANK 
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The  above  information  is  not  new  to  aircraft  designers  or  certification  personnel.  It  is  provided 
to  set  the  context  for  discussions  to  follow.  Categories  of  aircraft  established  by  the  authors  of 
this  report  are  arbitrary,  but  provide  a  starting  place  for  discussions  of  what  is  possible  in  CRFS 
design. 

5.3  DESIGN  CONSIDERATIONS 

5.3.1  Wing  Tank  Disruption. 

It  is  clear  from  airplane  crash  tests  (DC-7,  L-1649,  and  CID)  and  from  accident  data  that  the 
wings  of  large  transport  aircraft  can  be  totally  destroyed  and/or  tom  from  the  fuselage  without 
any  significant  forces  being  felt  by  occupants  of  the  aircraft.  It  is  therefore  irrelevant  to  discuss 
crash  protection  of  wing  fuel  tanks  in  terms  of  G  forces  felt  by  the  occupants.  Much  previous 
research  has  looked  at  various  approaches  to  wing  tank  protection,  such  as  bladders  and 
individual  tanks.  In  the  case  of  aircraft  larger  than  Category  A  aircraft,  current  state-of-the-art 
knowledge  does  not  offer  a  practical  solution. 

One  logical  approach  is  to  design  the  wings  so  that  when  they  are  tom  from  the  fuselage  or  are 
broken  into  several  sections  during  the  accident,  the  separations  will  occur  in  safe  areas,  rather 
than  through  fuel  tanks. 

This  would  require  strategically  located  small  dry  bays  between  wing  tanks  and  between  the 
tanks  and  the  fuselage.  Also,  self-sealing  points  of  separation  would  have  to  be  designed  into  the 
fuel  plumbing.  Landing  gear  loads  could  be  carried  by  the  aircraft  structure  in  such  a  manner 
that  crash  loads  would  cause  predictable  failures  in  fuel-free  areas,  rather  than  in  the  fuel  system. 
If  the  tanks  are  not  breached,  the  effectiveness  of  ullage  space  inerting  would  be  increased  and 
might  become  cost-effective. 

Another  area  of  consideration  is  the  material  properties  of  the  wing  tank  structures.  Some 
materials  deform  and  tear  in  a  ductile  manner  and  some  shatter  in  a  brittle  manner.  The  latter 
results  in  much  greater  destruction  of  the  tank  with  a  faster  release  of  fuel  during  the  impact 
sequence.  To  the  knowledge  of  the  authors  of  this  report,  there  are  no  design  requirements  for 
wing  tank  structures  regarding  these  failure  modes. 

5.3.2  Center  Tank  Disruption. 

The  center  tank  walls  on  large  low-wing  transport  aircraft  are  usually  a  part  of  the  strongest 
structure  of  the  airframe,  carrying  the  loads  between  the  wings  and  landing  gear  and  the  fuselage. 
In  gear  up  or  gear  separation  accidents,  these  tanks  can  contact  the  ground  and  can  dig  into  soft 
terrain  and  develop  high  G  loading.  They  can  also  be  impacted  by  parts  of  the  forward  fuselage 
and  nose  gear  during  forward  movement  during  the  crash  sequence.  Protection  of  these  tanks 
from  rupture  or  penetration  is  a  significant  task,  again,  in  accidents  which  may  not  deliver  high 
forces  to  occupants  other  than  those  on  seats  directly  above  the  tank.  In  addition,  the  location  of 
electrical  components  and  equipment  bays  is  often  adjacent  to  center  tanks,  providing  ready 
ignition  sources. 
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It  may  be  possible  to  design  crash-resistant  bladders  for  some  of  these  configurations.  However, 
this  would  require  changes  in  the  structural  design  of  current  aircraft  and  would  most  likely  have 
to  be  part  of  the  original  design,  not  a  retrofit  to  existing  designs.  Consideration  should  be  given 
to  designs  in  which  the  fuselage  will  not  dig  into  soft  terrain,  e.g.,  having  lower  bulkheads  canted 
aft  and/or  a  structural  keel  running  from  the  aircraft  nose  aft  toward  the  wing  forward  spar. 

Separation  of  the  fuselage  often  occurs  just  ahead  and  behind  the  center  wing  box  section.  When 
fuel  is  released  from  the  center  tank,  occupants  over  the  wing  can  have  fire  both  ahead  and 
behind  them.  Prevention  of  center  tank  fuel  loss  can  provide  a  significant  improvement  in  crash 
fire  survivability. 

5.3.3  Fuselage  Tanks. 

The  October  1999  drop  test  of  an  auxiliary  tank  in  the  lower  fuselage  of  a  B-737  section  resulted 
in  a  leak  due  to  penetration  of  the  tank  by  fuselage  longerons.  This  does  not  violate  any 
requirement  in  the  current  regulations.  However,  this  does  not  meet  the  requirement  of  the 
proposed  revision  to  14  CFR  Part  25.963  (NPRM  89-11  A,  see  section  8.44)  which  requires  that 
“Fuel  tanks  within  the  fuselage  contour  ...  be  located  in  a  protected  position  so  that  exposure  to 
penetration  or  damage  due  to  fuselage  deformation  ...  is  unlikely.” 

It  should  be  clear  that  such  tanks  can  be  located  in  various  places  in  large  transports,  such  as 
forward  of  the  wing,  immediately  aft  of  the  wing,  and  far  aft  in  the  cargo  compartment.  Each 
location  could  see  different  crash  environments  in  a  given  crash,  just  as  occupants  in  different 
parts  of  the  aircraft  can  see  different  crash  forces  and  effects.  In  addition,  testing  of  these  tanks 
has  been  confined  to  a  single  direction  of  impact  load,  rather  than  the  combined  effects  of  real 
crash  loads.  A  tank  in  the  forward  cargo  area  could  see  both  aft  and  upward  impact  loads,  as 
well  as  possible  impact  by  nose  gear  components.  Again,  the  loads  on  a  tank  in  the  lower  cargo 
area  are  likely  to  be  much  different  than  those  experienced  by  occupants  above  the  floor,  and  to 
use  the  loading  criteria  for  occupants  for  any  such  installation  is  unrealistic. 

Development  of  appropriate  impact  conditions  for  specific  locations  of  main  and  auxiliary  tanks, 
including  those  in  the  horizontal  and  vertical  tail,  should  be  a  task  undertaken  by  fuel  system 
designers.  In  addition,  consideration  of  the  effect  of  the  tank  on  occupants  seated  above  the  tank 
should  be  part  of  the  design  task  since  drop  tests  have  shown  that  the  forces  on  seats  above  the 
tank  were  higher  than  on  seats  not  located  above  tanks. 
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6.  STATUS  OF  CURRENT  TRANSPORT  CKFS  TECHNOLOGY  AND  IMPLEMENTATION. 


6.1  COMPARISON  OF  MILITARY  AND  CIVIL  CRASH  ENVIRONMENTS. 

Accidents  of  large  transport  aircraft,  both  civil  and  military,  have  been  studied  for  over  50  years. 
Some  of  those  studies  were  specifically  directed  toward  crashworthiness,  and  some  of  the 
crashworthiness  studies  were  specifically  focused  on  the  postcrash  fire  issue.  Throughout  this 
period,  the  military  studies  have  been  both  comprehensive  and  extensive.  Conversely,  the  civil 
studies  have  been  more  sporadic;  however,  they  have  been  able  to  benefit  greatly  from  the 
knowledge  gained  from  the  military  effort. 

A  review  of  past  military  and  civil  studies  indicates  that  there  are  significant  differences  between 
the  researchers’  definitions  of  the  upper  level  serious,  but  survivable  accident.  The  helicopter 
industry  attempts  to  define  its  upper  level  survivable  accident  as  a  function  of  velocity  changes 
over  a  given  time  frame  and  the  maintenance  of  safe  space  around  the  occupant  throughout  the 
crash  sequence.  When  presented  as  a  function  of  vertical  velocity  only,  it  has  been  suggested 
that  the  upper  level  for  the  civil  helicopter  is  around  26  ft/sec.  The  military  helicopter  is 
engineered  for  greater  survivability  and  can  protect  its  occupants  in  accidents  with  vertical 
impact  velocities  of  up  to  42  ft/sec  or  more  and  resultant  velocities  of  65  ft/sec.  or  more, 
depending  on  whose  study  is  being  reviewed.  Efforts  to  correlate  similar  civil  and  military  data 
for  large  transport  aircraft  is  currently  not  possible  because  of  the  lack  of  necessary  accident 
data. 

Military  and  civil  researchers  tend  to  think  that  their  respective  aircraft  as  being  different  from 
those  of  the  other  group.  While  this  is  true  to  some  extent,  many  military  aircraft  have  civil 
counterparts.  It  is  generally  believed  by  the  civil  sector  that,  because  their  aircraft  fly  different 
missions,  they  crash  differently.  It  is  the  opinion  of  the  authors  of  this  report  that  the  crash 
differences  are  not  as  great  as  generally  believed  by  the  civil  sector.  Whichever  opinion  is 
correct,  the  real  issue  is  that  there  is  no  clear  understanding  of  the  actual  civil  and  military  large 
transport  aircraft  crash  scenarios,  because  insufficient  data  has  been  collected  to  support 
comprehensive  conclusions. 

The  overall  intent  of  crashworthiness  integration  into  a  given  aircraft  design  is  to  save  lives. 
Charts,  such  as  those  shown  in  figures  6-1  and  6-2,  can  quickly  put  the  crash  survivability  issue 
into  perspective.  Enlarging  the  survivability  segment  is  an  obvious  goal.  Although  the  actual 
segment  sizes  portrayed  on  the  charts  are  for  illustrative  purposes  only,  charts  such  as  these  need 
to  be  developed  from  actual  crash  data  to  focus  research  efforts  toward  saving  more  lives. 


6-1 


LARGE  TRANSPORT  AIRCRAFT  CRASHES 

SURVIVABILITY  PERCENTAGE 


FIGURE  6-1.  PERCENTAGE  OF  ALL  LARGE  TRANSPORT  AIRCRAFT  CRASHES  THAT 
ARE  SURVIVABLE,  PARTIALLY  SURVIVABLE,  AND  NONSURVI V ABLE 
(Segment  sizes  are  for  illustrative  purposes  only  and  are  not  based  on  actual  data.) 


SEVERITY  SCALE  . 


SEVERITY  COULD  BE 

BASED  ON  - 

•  Velocities  at  Impact 

•  Velocity  Changes  at 
Impact 

•  Impact  Attitudes 

•  Impact  Angles 

•  Available  Livable 
Space 

•  Fatality  Count 

•  Other  Units  and/or 
combination  of  the 
above 


FIGURE  6-2.  SEVERITY  SCALE  OF  ALL  LARGE  TRANSPORT  AIRCRAFT  CRASHES 
(Segment  sizes  are  for  illustrative  purposes  only  and  are  not  based  on  actual  data.) 
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Both  the  military  and  the  civil  sectors  have  endeavored  to  design  sufficient  crash  resistance  into 
their  respective  aircraft  to  enable  them  to  state  that  their  aircraft  are  capable  of  protecting 
occupants  from  the  anticipated  crash  loads  defined  in  applicable  FARs  and  military 
requirements.  While  this  statement  conveys  that  a  level  of  protection  exists,  it  does  not  give  any 
indication  of  the  percentage  of  accidents  that  is  protected.  The  95th  percentile  upper  limit 
survivable  accident  is  one  of  the  units  of  measurement  used  by  helicopter  designers  when 
discussing  the  relative  crashworthiness  level  of  their  helicopters.  No  such  unit  of  measurement 
has  been  developed  for  large  transport  aircraft.  The  95th  percentile  upper  limit  survivable 
accident,  simply  stated,  means  that  95%  of  the  survivable  accidents  are  of  this  severity  or  less.  It 
does  not  indicate  what  percentage  of  all  accidents  is  survivable. 

Survivable  accidents  as  a  percentage  of  all  accidents  depends  on  the  crash  resistance  of  the 
airframe  and  the  level  of  protection  afforded  by  the  seats  and  restraint  systems,  as  well  as  the  fuel 
system.  Before  aircraft  designers  can  develop  significant  crash-resistant  improvements,  they 
must  think  of  survivable  accidents*  in  terms  of  human  tolerance  levels,  and  not  in  terms  of  the 
number  of  accidents  in  which  people  are  killed.  The  two  most  commonly  used  methods  of 
determining  survivability  are  counting  the  dead  and  determining  the  G/time  histories  known  to 
be  survivable  coupled  with  the  maintenance  of  livable  space  throughout  the  entire  crash 
sequence.  It  has  been  theorized  by  researchers  attempting  to  define  the  “survivable  accident” 
that  a  positive  correlation  exists  between  these  two  methods.  This  correlation,  however  good  it 
may  be,  does  little  to  help  the  aircraft  designer  because  defining  survivability  by  using  a  body 
count  rarely  yields  sufficient  engineering  data  to  permit  the  design  of  retrofit  kits  for  the  existing 
fleet,  let  alone  the  design  of  new  aircraft  for  which  there  is  no  accident  data  available. 

Some  researchers  who  have  studied  accident  severity  (relative  to  human  survival  in  elevated  G 
versus  time  environments)  have  concluded  that  velocity  in  the  vertical  direction,  as  opposed  to 
the  longitudinal  or  lateral  direction,  is  the  most  life  threatening,  because  vertical  velocity  is 
reduced  to  zero  so  quickly  during  most  ground  impacts  that  high  G  forces  are  transmitted  to  the 
occupants.  The  authors  of  this  report  agree  that  vertical  forces  are  a  major  threat  but  not  to  the 
exclusion  of  longitudinal  forces.  This  is  especially  true  when  one  considers  that  the  longitudinal 
velocity,  which  is  usually  the  higher  of  the  two,  combines  with  the  vertical  velocity  to  produce 
the  actual  crash  forces  that  are  transmitted  to  the  occupants  and  to  the  fuel  system  during  the 
crash  impact  and  slide  out. 

Longitudinal  velocity  usually  transmits  lower  G  forces  to  the  aircraft  occupants  because  the 
aircraft  takes  longer  to  stop  in  the  longitudinal  direction.  While  this  lower  G  environment  is 
favorable  from  the  standpoint  of  the  occupant,  it  creates  two  additional  major  threats  to  the  fuel 
system. 

First,  when  portions  of  the  aircraft  start  to  slow  down  in  the  longitudinal  direction,  they  are  often 
brought  to  an  abrupt  halt  by  contacting  heavy  or  unyielding  objects  such  as  automobiles, 
telephone  poles,  stumps,  and  rocks.  The  localized  G  forces  generated  by  these  abrupt  stops  are 


*  A  survivable  helicopter  accident,  as  defined  by  the  U.S.  Army,  the  NTSB,  and  by  crash  survivability  researchers  in 
the  field,  is  an  accident  in  which  the  forces  transmitted  to  the  occupant  through  the  seat  and  restraint  system  do  not 
exceed  the  limits  of  human  tolerance  and  in  which  a  safe  space  around  the  occupant  is  maintained  throughout  the 
entire  crash  sequence. 
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usually  far  greater  than  those  transmitted  to  the  occupants  in  both  the  longitudinal  and  vertical 
durection.  If  part  of  the  fuel  system  is  located  in  these  areas  (e.g.,  the  front  or  bottom  of  the 
aircraft),  it  will  experience  these  higher,  localized  forces.  Unless  the  entire  fuel  system  is  located 
away  from  these  anticipated  impact  areas,  it  must  be  designed  to  withstand  much  higher  G  levels 
than  the  occupants.  Thus,  overall  aircraft  velocity  change  data  cannot  be  used  directly  as  criteria 
for  CRFS  design.  Additionally,  any  attempt  to  establish  different  design  and/or  test  criteria  for 
civil  versus  military  CRFS  should  be  based  on  detailed  accident  studies  and  extensive  testing, 
not  just  on  differences  in  overall  aircraft  velocity  changes  during  the  crash  sequence. 

Second,  extensive  structural  displacement  occurs  during  the  wreckage  slide  out,  and  this 
displacement  literally  pulls  the  fuel  system  apart.  The  CRFS  designer  must  factor  in  this 
displacement  by  allowing  the  fuel  system  to  move  separately  from  the  structure  without 
significant  leakage.  Where  the  displacement  is  not  expected  to  be  large,  frangible  attachments 
and  flexible,  extra-length  fuel  lines  might  suffice.  In  areas  of  extensive  structural  displacement, 
the  CRFS  designer  must  either  (1)  move  the  fuel  system  out  of  the  area  or  (2)  design  in  “safe 
failure  points”  by  using  self-sealing  breakaway  valves,  etc.  In  both  cases,  the  fuel  system 
components  must  also  be  able  to  withstand  all  the  crash  forces  likely  to  occur  in  their  locations. 

6.2  CRASH-RESISTANT  FUEL  SYSTEM  DESIGN  ISSUES. 

The  principal  objective  of  implementing  CRFSs  in  aircraft  is  to  protect  the  occupants  from 
injuries  caused  by  postcrash  fire.  Properly  designed  and  configured  CRFSs  can  (in  order  of 
preference)  (1)  prevent  the  onset  of  a  postcrash  fire  by  containing  all  fuel  and  other  flammable 
liquids;  (2)  delay  the  onset  or  minimize  the  severity  of  postcrash  fire  by  minimizing  spillage  or 
directing  it  away  from  potential  ignition  sources;  or  (3)  isolate  a  postcrash  fire  from  impinging 
on  occupied  areas  of  the  airframe  long  enough  for  occupants  to  make  their  way  to  safety. 

The  predominant  criterion  for  aircraft  designers  is  to  determine  the  level  of  severity  of  a  crash 
that  must  be  accommodated  by  the  CRFS.  The  traditional  large  transport  aircraft  approach  has 
attempted  to  provide  a  fuel  system  that  will  survive  the  crash  loads  specified  in  the  FARs  without 
a  dangerous  spillage  of  fuel.  A  CRFS  must  safely  survive  crash  environments  in  which 
extensive  structural  displacement  occurs,  such  as  often  occurs  during  accidents  with  high 
longitudinal  speed  or  impacts.  As  straightforward  as  the  objective  appears,  it  is  difficult  to 
achieve  in  practice  unless  the  designer  has  sufficient  knowledge  and  data  available  to  define  the 
approximate  crash  parameters  of  “survivable”  accidents  in  the  type  of  aircraft  in  question.  In 
addition,  advances  in  other  areas  of  crash  survivability,  e.g.,  seats  and  restraints  that  attenuate 
crash  forces  transmitted  to  occupants,  have  allowed  occupants  to  survive  in  accidents  that  are 
severe  enough  to  totally  destroy  the  aircraft.  It  is,  therefore,  not  unreasonable  to  require  the 
CRFS  to  safely  contain  fuel  throughout  the  entire  severe  crash  sequence. 

CRFS  designers  for  helicopters  and  light  airplanes  routinely  use  occupant  survivability  data  as 
their  criteria  for  fuel  system  design.  This  data,  in  the  form  of  loads  generated  by  the  velocity 
changes  experienced  during  95th  percentile  survivable  crashes,  is  based  on  innumerable,  in-depth 
accident  investigations  and  extensive  full-scale  crash  tests.  The  vertical  velocity  changes 
experienced  by  these  small  aircraft  as  determined  from  accident  data,  are  shown  in  figure  6-3. 
This  figure  shows  that  the  95th  percentile  survivable  crash  has  a  vertical  velocity  change  of  42 
ft/sec  in  the  occupiable  area  during  the  major  impact. 


6-4 


50 


8  40 
to 


oT 

DU 


0  -4 - 1 - 1 - 1 - f- - 1 - 1 - \ - 1 - ! - 1 

0  10  20  30  40  50  60  70  80  90  100 

Cumulative  Frequency  of  Occurance,  percent 

FIGURE  6-3.  VERTICAL  VELOCITY  CHANGES  FOR  SURVIVABLE  ACCIDENTS  IN 
SMALL  AIRCRAFT  (Rotary  and  light  fixed  wing) 

Unfortunately,  these  criteria  cannot  be  transferred  directly  to  transport  airplanes  because  of  their 
larger  size.  Indeed,  even  defining  “a  survivable  accident”  for  transport  airplanes  in  the  context 
of  velocity  change  during  impact  is  questionable.  The  definition  of  a  survivable  impact 
ultimately  relates  back  to  human  tolerance  levels  to  applied  forces,  accelerations,  and  their 
durations.  If  the  aircraft  and  the  occupant  both  experience  similar  velocity  changes  during  a 
crash,  then  crash  survivability  can  be  defined  by  the  aircraft  response  in  its  occupiable  area,  at  or 
near  the  aircraft  center  of  gravity.  This  is  the  case  with  small  aircraft,  such  as  helicopters  and 
light  airplanes.  This  principle  is  illustrated  for  small  aircraft  in  figure  6-4.  The  center  of  gravity 
(eg)  of  the  aircraft  shown  in  figure  6-4  is  denoted  by  the  small  checkerboard  circle.  The  large 
cross-hatched  areas  fore  and  aft  of  the  eg  encompasses  the  occupant  area.  As  can  be  seen  in  the 
figure,  the  occupant  area  in  the  small  aircraft  is  not  large  enough  or  far  enough  away  from  the  eg 
to  experience  significant  differences  in  velocity  changes  during  an  accident.  Thus,  the  velocity 
changes  and  accelerations  seen  at  the  aircraft  eg  are  reasonably  valid  throughout  the  occupiable 
area. 

On  the  other  hand,  the  passenger  compartment  in  a  large  transport  airplane  is  much  larger  and  a 
significant  number  of  occupants  are  located  a  considerable  distance  away  from  the  airplane’s  eg. 
They  are  outside  the  area  of  the  airplane  which  can  be  expected  to  have  similar  velocity  changes 
to  those  at  the  eg  during  impact.  The  cross-hatched  area  A  of  figure  6-4  indicates  an  area  that 
will  likely  experience  similar  velocity  changes  as  the  eg,  whereas  cross-hatched  area  B  will 
likely  have  significantly  different  velocity  changes  during  the  accident.  KRASH  analysis  has 
shown  that  sink  velocities  over  22  ft/sec  would  likely  break  the  fuselage  shell  and  that  22  to  25 
ft/sec  might  be  a  reasonable  survivable  limit  for  the  overall  passenger  compartment  of  large 
transport  aircraft  (see  section  2.3.4).  This  value  is  considerably  lower  than  the  42  ft/sec  vertical 
velocity  change  for  the  95th  percentile  survivable  accident  in  the  smaller  aircraft. 
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FIGURE  6-4.  OCCUPLABLE  AREA  SIZE  AND  LOCATION  RELATIVE  TO  THE 
CENTER  OF  GRAVITY  IN  LARGE  AND  SMALL  AIRCRAFT 

Should  the  designer  then  use  25  ft/sec  vertical  velocity  change  as  one  of  the  criteria  for  the  95th 
percentile  survivable  accident  for  transport  airplanes?  No!  Using  this  value  presupposes  that  the 
velocity  changes  and  accelerations  are  similar  throughout  the  entire  passenger  compartment 
enclosed  by  area  B  in  figure  6-4.  However,  this  supposition  is  not  valid.  It  was  previously 
shown  that  the  area  over  the  center  wing  is  stronger  than  the  fore  and  aft  sections  of  the  fuselage. 
Drop  tests  have  shown  that  vertical  velocities  up  to  30  ft/sec  are  readily  survivable  for  occupants 
near  the  center  section  (see  section  3.2).  In  addition,  passengers  seated  in  the  fore  and  aft 
sections  of  the  aircraft  may  experience  widely  diverse  impact  conditions  depending  on  the 
dynamics  of  the  specific  accident. 

At  the  present  time,  there  is  no  single  value  which  will  adequately  define  the  vertical  velocity 
change  of  the  95  percentile  survivable  accident  for  large  transport  airplanes.  If  the  values  of 
20-25  ft/sec  are  used  by  the  CRFS  designer,  there  is  a  grave  danger  that  the  CRFS  will  fail  at 
levels  well  below  the  survivable  range  of  many  of  the  airplane  occupants  and  expose  the 
surviving  occupants  to  a  crash  fire.  There  is  an  urgent  need  to  define  the  velocity  changes  which 
are  survivable  throughout  the  aircraft  during  typical  transport  airplane  crashes.  The  time  and 
effort  must  be  spent  to  define  how  these  impact  conditions  should  be  measured  and  to  gather  the 
necessary  data.  Only  then  can  the  CRFS  designer  be  confident  that  the  fuel  system  will 
accomplish  its  intended  purpose  of  protecting  the  occupants  from  fire  up  to  the  survivable  limits 
of  transport  airplane  accidents. 

In  the  April  2000  FAA  study  titled  “Benefit  Analysis  for  Aircraft  16-g  Dynamic  Seats”  [60], 
R.G.W.  Cherry  and  Associates,  Ltd.  defines  the  methodology  and  rationale  for  a  new 
mathematical  model  called  a  “Survivability  Chain:” 
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Accident  Scenarios 


The  severity  of  hazard  in  an  accident  can  vary  markedly  throughout  the  aircraft. 
Experience  has  shown  that  considering  occupant  injuries  on  a  whole  aircraft  basis 
can  be  misleading  when  assessing  the  effects  of  survivability  factors.  It  is  therefore 
necessary  to  divide  the  aircraft  into  scenarios. 

A  scenario  is  defined  as  “That  volume  of  the  aircraft  in  which  the  occupants  are 
subjected  to  a  similar  level  of  threat.  ”  (emphasis  in  the  original). 

A  similar  level  of  threat  need  not  necessarily  result  in  the  same  level  of  injury  to 
occupants.  The  extent  of  injury  sustained  can  vary  with  numerous  factors  including 
age,  sex,  adoption  of  the  brace  position,  etc.  Furthermore,  the  threat  to  occupants 
can  vary  over  relatively  small  distances.  For  example,  a  passenger  may  receive  fatal 
injuries  because  of  being  impacted  by  flying  debris,  and  a  person  in  an  adjacent  seat 
may  survive  uninjured.  Dividing  accidents  into  scenarios  provides  a  more 
meaningful  basis  on  which  to  analyze  accidents  than  considering  the  whole  aircraft 
due  to  the  marked  variation  in  survival  potential  with  occupant  location. 

Survivability  Chain 

A  mathematical  model,  known  as  a  Survivability  Chain  (see  figure  6-5)  . . .  enables 
assessment  to  be  made  of  the  overall  effect  on  survivability  factors,  taking  into 
account  injuries  that  may  be  sustained  by  occupants. 

. . .  Where  sufficient  data  are  available,  each  accident  is  divided  into  scenarios  and  a 
Survivability  Chain  constructed. 


FIGURE  6-5.  EXAMPLE  OF  SURVIVABILITY  CHAIN  FOR  AN  ACCIDENT  SCENARIO 

(From  reference  60) 
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The  Survivability  Chain  enables  analysis  of  the  effects  of  specific  improvements  to  survivability 
factors  on  each  scenario  (see  above  definition)  which  might  be  present  within  the  passenger 
compartment.  For  each  scenario,  a  numerical  assessment  can  be  made  of  the  effects  of  changes 
on  numbers  of  fatalities  and  injuries.  The  Cherry  report  continues: 

Whilst  it  is  recognized  that  the  models  are  not  perfect  representations  of  an  accident 
nor  are  the  statistical  assessments  totally  accurate,  they  will  provide  a  better 
assessment  of  the  likely  effects  of  improvements  to  survivability  factors  that  would 
otherwise  be  derived  from  a  simple  estimate  of  the  resultant  change  in  number  of 
survivors. 

Applying  Survivability  Chain-or  similar-analysis  methodology  to  the  effects  of  postcrash  fires 
can  improve  the  robustness  of  data  on  which  decisions  are  made  for  pursuing  new  initiatives 
toward  minimizing  occupant  risk.  For  example,  current  ad  hoc  investigation  techniques 
minimize  the  likelihood  of  recognizing  patterns  of  evidence  which  might  identify  inherent  design 
factors  which  increase  risk.  Standardized  investigation  methodologies  are  required  to  enable 
valid  statistical  identification  and  follow-up  of  existing  survivability  factors  and  their 
improvements. 

The  CRFS  must  be  designed  within  the  constraints  of  aircraft  performance  requirements  and 
within  the  boundaries  of  numerous  rules  and  regulations.  Standards,  regulations,  and 
specifications  have  been  established  for  CRFS  design  for  both  civil  and  military  helicopters. 
Many  of  these  standards  are  directly  applicable  to  large  transport  aircraft,  the  subject  of  this 
study,  and  are  discussed  throughout  this  report. 

The  acceptable  crash  fire  environment  must  also  be  defined.  While  complete  elimination  of 
postcrash  fire  is  the  surest  way  to  prevent  fire  injuries,  it  is  sometimes  possible  to  prevent 
injuries  even  if  a  postcrash  fire  occurs  by  minimizing  the  size  of  the  fire  and  isolating  it  from  the 
occupants  long  enough  for  them  to  escape.  The  designer  can  estimate  the  reduction  of  the 
postcrash  fire  hazard  of  various  CRFS  modifications  by  using  appropriate  hazard  analyses  and 
risk  assessment  procedures  discussed  in  section  7  of  this  report. 

Within  the  framework  of  all  of  these  considerations,  highly  successful  crash-resistant  fuel 
systems  have  been  designed  and  utilized.  This  section  of  the  report  summarizes  the  current 
status  of  knowledge  in  CRFS  technology  and  the  level  of  implementation  of  CRFS  in  large 
transport  aircraft. 

6.3  GENERAL  SYSTEM  DESIGN  CRITERIA. 

Crashworthy  fuel  system  design  must  fit  within  the  framework  of  established  fuel  system  design 
parameters.  These  overall  criteria  may  be  summarized  in  the  following  outline: 

•  Aircraft  Performance 

Operating  Conditions 
Crash  Conditions 

Occupant  Survivability  Level  Desired/Possible 
Structural  Reaction  to  Crash 
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•  Overall  Fuel  System  Design 

Performance 

Simplicity 

Reliability 

Location 

•  Individual  Component  Design 

Location 

Performance  (operational  and  crash  resistant) 

Materials 

Reliability 

Maintenance 

•  Design  Aids 

Standards 
Checklists 
Hazard  Analyses 
Handbooks  and  Guides 

6.3.1  Aircraft  Performance. 

The  primary  factor  to  be  considered  in  fuel  system  design  is  the  performance  required  of  the 
aircraft.  The  system  must  be  designed  to  allow  the  aircraft  to  accomplish  its  design  goals  and  to 
operate  successfully  during  all  required  operational  modes  of  the  aircraft.  This  principle  must  be 
followed  in  successful  CRFS  design  as  well.  However,  the  CRFS  also  must  be  designed  to 
perform  its  intended  function  of  preventing  or  minimizing  dangerous  spillage  and  resulting 
postcrash  fire.  To  that  end,  the  criteria  listed  in  italics  in  6.3  pertain  specifically  to  crash- 
resistant  design  and  generally  have  not  been  included  previously  in  standard  fuel  system  design 
criteria. 

The  common  parameters  of  crash  conditions  for  the  type  of  aircraft  in  question  must  be  defined 
and  quantified  in  order  to  determine  the  level  of  performance  expected  for  the  CRFS.  For 
example,  large  aircraft  tend  to  crash  with  higher  vertical  and  longitudinal  velocities  than  do  small 
aircraft.  Expected  crash  velocities  must  be  obtained  from  accident  data  gathered  for  the  aircraft 
in  question  or  extrapolated  from  crash  data  on  similar  specific  aircraft  models.  The  occupant 
survivability  level  in  these  crashes  must  be  ascertained.  The  survivability  criteria  could  be 
defined  in  terms  of  crash  loads  transmitted  to  properly  restrained  occupants  and  to  the 
preservation  of  occupiable  space  around  the  occupant,  irrespective  of  whether  the  occupants  did 
or  did  not  survive  [85].  Whatever  criteria  are  selected,  they  must  be  correlated  with  the  level  of 
occupant  survivability  desired. 

Before  the  CRFS  can  be  designed,  the  aircraft  structural  response  to  these  anticipated  crash 
conditions  must  be  determined.  Crash  data  can  be  helpful  in  determining  structural  response  of 
similar  designs.  Design  analyses  and  computer  studies  should  also  be  utilized  to  determine 
anticipated  failure  modes  and  locations  of  structural  deformation  during  crashes.  This 
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information  is  essential  in  determining  CRJFS  component  locations  and  performance 
requirements. 

6.3.2  Overall  Fuel  System  Design. 

The  fuel  system,  as  an  integrated  system,  must  be  designed  to  function  under  all  foreseeable 
environmental  and  operational  conditions  that  might  be  encountered  during  the  life  cycle  of  the 
aircraft.  The  CRFS  must  perform  its  function  within  the  desired  survivable  crash  envelope  as  a 
whole  system  and  not  simply  a  collection  of  individual  components.  Whatever  conditions  are 
imposed  upon  a  component  and  its  reaction  to  those  conditions  could  well  compromise  the 
integrity  of  an  adjacent  component  (e.g.,  if  a  fuel  line  is  trapped  in  a  deforming  and  separating 
structure,  the  forces  transmitted  through  the  line  might  pull  the  hose  out  of  the  hose-end  fitting, 
break  the  hose  end  fitting  or  break  the  component  that  is  attached  to  the  hose-end  fitting' 
allowing  fuel  leakage  even  if  the  integrity  of  the  hose  itself  is  maintained). 

The  location  of  the  fuel  system  and  its  components  is  constrained  by  the  configuration  and 
performance  requirements  of  the  aircraft.  However,  the  CRTS  location  must  be  incorporated 
into  the  aircraft  very  early  in  the  design  process  so  that  the  fuel  system  and  its  components  are 
protected  from  crash  damage  to  the  maximum  extent  possible. 

Accurate  crash  data  does  not  currently  exist  to  either  define  the  level  of  airframe  structural 
damage  or  the  level  of  occupant  survivability  as  functions  of  impact  velocities  and  resultant  G 
forces.  As  a  consequence,  today’s  CRFS  designer  is  unable  to  accurately  determine  the  crash 
severity  level  in  which  the  CRFS  must  safely  contain  fuel. 

Two  concurrent  paths  could  be  followed  to  eliminate  the  dilemma  that  the  CRFS  designer  faces. 
First,  the  CRFS  designer  must  be  given  access  to  crash  severity  data  recorded  by  skilled  crash 
investigators  from  detailed  crash  investigations  that  are  conducted  both  in  the  field  and  through 
review  and  analysis  of  past  accident  investigation  reports. 

Second,  pending  the  accumulation  of  accurate  crash  data,  the  CRFS  designer  should  design  the 
CRFS  to  withstand  the  structural  loads  and  structural  displacements  that  occur  during  typical 
takeoff  and  landing  accidents.  These  accidents  are  the  most  likely  to  have  survivors.  Overall 
observations  of  the  effects  of  crash  loads  and  structural  displacements  in  takeoff  and  landing 
accidents  clearly  indicate  the  following  typical  fire  producing  scenarios: 

a.  Engines  are  displaced. 

b.  Fuel  tanks  are  ruptured. 

c.  Fuselages  are  crushed  and  often  broken  and/or  separated  into  various  segments. 

d.  Wing  leading  edges  and  wing  root  areas,  especially  those  in  and  near  the  landing  gears, 
are  severely  damaged. 
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e.  Fuel  and  oil  lines  are  cut,  tom,  pulled  from  their  end  fittings  or  otherwise  broken  in  such 
a  manner  that  dangerous  spillage  occurs,  and  are  often  made  more  hazardous  because  the 
fluids  are  heated  and/or  pressurized. 

f.  Fuel  and  oil  system  components  are  damaged  causing  dangerous  spillage. 

The  fire  threat  associated  with  these  readily  foreseeable  hazardous  situations  can  be  greatly 
reduced  by  using  fuel  system  design  aids  such  as  the  Fuel  System  Hazard  Level  Reduction 
process  discussed  in  Section  7.2,  the  Fuel  System  Design  Checklist  in  appendix  C  and  by 
implementing  the  following  basic  CRFS  design  concepts: 

a.  Incorporate  state-of-the-art  crashworthy  bladders  in  as  many  fuel  tanks  as  is  reasonably 
practical. 

b.  Avoid  locating  fuel  and  oil  lines  in  areas  of  anticipated  impact  or  extensive  structural 
displacement. 

c.  If  unable  to  safely  locate  fuel  and  oil  lines,  incorporate  self-sealing  breakaway  valves  in 
the  lines  where  impact  and  extensive  displacement  is  anticipated. 

d.  Incorporate  methods  to  stop  the  pressurization  of  crashed  aircraft  fuel  and  oil  lines. 

e.  Incorporate  penetration-resistant  structures  in  areas  vulnerable  to  damage  by  blown  tires, 
shattered  wheels,  landing  gear  struts  and  trunions,  and  by  wing  slats,  flaps,  gear  doors 
and  other  structures  that  may  be  driven  into  areas  of  the  aircraft  where  fuel  is  located, 
either  in  tanks  or  in  the  plumbing  system. 

The  design  philosophy  for  the  CRFS  must,  by  necessity,  follow  two  paths.  One  defines  the 
probable  or  anticipated  fuel  spillage  methods  that  will  occur  at  the  crash  severity  level  selected, 
while  the  other  evaluates  the  relative  crash-resistant  features  of  the  specific  items  making  up  the 
CRFS.  As  an  example,  if  a  fuel  filter  assembly  does  not  incorporate  a  high  level  of 
crashworthiness  in  its  design,  it  could  still  function  safely  in  a  crash  if  it  were  mounted  in  an  area 
that  was  deemed  to  remain  “safe”  during  the  upper  limit  survivable  accident.  However,  if  the 
component  must  be  located  in  an  area  where  extensive  crash  damage  is  likely,  the  component 
must  incorporate  crash  safety  features  inherent  in  its  design. 

Some  crashworthy  design  features  incorporated  in  current  transport  airplanes  involve  the  use  of 
fuel  shut  off  valves  that  can  be  closed  by  the  flight  crew  two  completely  separate  ways,  either 
electrically  or  by  mechanical  linkages.  The  concept  being  that  if  one  method  is  rendered 
inoperative,  the  other  can  still  be  used. 

Another  crashworthy  scheme  employed  in  some  current  airplanes  is  to  route  the  fuel  lines  in 
such  a  manner  that  as  the  engine  or  other  components  are  separated  from  the  airframe,  the 
pulling  force  applied  to  the  fuel  line  causes  it  to  break,  predictably,  down  stream  of  manually 
actuated  shutoff  valves,  rather  than  remain  intact,  literally  pulling  the  fuel  lines  out  of  the 
airframe  -  shutoff  valves  included. 
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The  design  of  the  fuel  system  should  be  kept  as  simple  as  possible  commensurate  with  its  design 
objectives.  Simplicity  generally  leads  to  increased  reliability  and  ease  of  maintenance.  There  is 
an  added  benefit  for  the  CRFS — simplicity  generally  reduces  the  number  of  possible  unsafe 
failure  points  during  a  crash. 

6.3.3  Individual  Component  Design. 

Fuel  system  components  are  routinely  designed  to  be  structurally  sound  during  all  normal  flight 
and  service  loads.  These  components,  with  no  modification,  could  be  used  to  create  a  CRTS  that 
would  function  as  desired  in  the  selected  upper  level  survivable  accident.  To  do  so,  however, 
could  require  that  the  airframe  behave  in  a  specific  manner  regardless  of  the  crash  environment. 
Further,  it  is  probable  that  structural  enhancement  and  reinforcement  would  be  required  in  areas 
where  the  noncrashworthy  components  were  located.  While  such  a  CRFS  could  be  built,  the 
weight  and  other  design  considerations,  i.e.,  component  location  and  fuel  line  routing,  render  the 
approach  less  than  desirable. 

A  great  deal  of  information  has  been  written  about  the  design  of  CRFS  components.  The 
Aircraft  Crash  Survival  Design  Guide  is  the  most  comprehensive  and  most  current  source  of  this 
material  [86]  and  should  be  the  designers’  principal  reference  for  design  guidance.  There  are 
several  key  components  of  the  CRFS,  however,  that  are  worthy  of  additional  discussion.  They 
are  the  fuel  tanks  and  its  fittings,  the  self-sealing  breakaway  valve,  the  fuel  lines  and  their 
fittings,  vent  valves,  drain  valves,  and  spillage  control  valves.  If  the  reader  wishes  to  obtain 
more  detailed  information  regarding  these  components,  refer  to  the  Aircraft  Crash  Survival 
Guide,  which  has  been  a  helpful  aid  for  the  following  discussion. 

6.3.4  Tanks  and  Fittings. 

Transport  aircraft  flying  today  carry  their  fuel  in  different  types  of  tanks.  Some,  referred  to  as 
integral  tanks,  are  merely  open  areas  within  the  wings,  sealed  with  a  coating  to  prevent  seepage. 
Others  utilize  bladders  of  varying  degrees  of  crashworthiness.  Still  others  use  tanks  made  of 
metal  or  various  composite  materials. 

The  ideal  fuel  system  is  one  that  completely  contains  its  contents  both  during  and  after  an 
accident  of  such  severity  as  to  be  at  or  slightly  above  the  upper  limit  of  human  survivability.  The 
fuel  must  be  contained  no  matter  how  the  basic  structure  fails  and  regardless  of  the  magnitude  of 
the  displacements  of  the  fuel  system  components  relative  to  the  aircraft  structure.  Similarly,  all 
possible  crushing  loads,  penetrative  loads,  and  inertia  loads  must  be  carried  without  leakage. 
Integral  tanks,  in  spite  of  the  various  efforts  to  improve  their  containment  capabilities,  are  not 
presently  able  to  safely  contain  their  contents  in  most  accidents  where  human  life  is  threatened. 
The  most  reliable  “fuel  containment  concept”  today  involves,  as  a  prime  element,  the  use  of 
flexible,  high  strength,  cut-  and  tear-resistant  fuel  bladders  built  with  construction  materials  and 
fittings  that  improve  the  ability  of  a  fuel  system  to  contain  fuel  under  survivable  impact 
conditions.  Although  this  ideal  fuel  system  is,  at  times,  difficult  to  achieve,  the  military 
helicopter  accident  history  over  the  past  25  years  clearly  demonstrates  that  it  can  be  done. 

While  the  researchers  and  developers  of  the  1950s  would  undoubtedly  embrace  the  definition  of 
the  ideal  fuel  system,  and  while  they  would  applaud  today’s  application  of  the  fuel  containment 
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concept,  their  own  efforts  were  generally  unsuccessful.  Their  early  work  [20  and  21]  ultimately 
resulted  in  the  issuance  of  MIL-T-27422  and  MIL-T-27422A,  but  exhaustive  testing  of  the 
requirements  contained  in  those  specifications  was  not  undertaken  until  the  AvSER  research  of 
the  1960s. 

The  testing  of  the  crash-resistant  fuel  tanks  developed  in  accordance  with  MIL-T-27422A 
revealed  at  least  three  major  shortcomings.  The  first  was  the  underestimation  of  the  vertical, 
longitudinal,  and  lateral  loads  being  applied  to  the  fuel  system  in  severe,  but  survivable 
accidents.  Since  many  aircraft  fuel  tanks  are  located  low  in  the  structure,  in  the  wings  and/or 
very  near  the  airframe  outer  surfaces,  they  are  subject  to  severe  loads.  Additional  loads  can  be 
added  to  the  tanks  by  the  close  proximity  of  passengers,  cargo,  landing  gear,  and  in  some  cases, 
the  engine. 

The  second  shortcoming  was  the  failure  to  consider  the  fuel  tank  fitting  pull-out  problem  and  the 
puncture  and  tear-resistance  properties  of  the  fuel  tank  that  are  needed  to  prevent  penetration  by 
the  jagged  metal  and  broken  spear-shaped  components  of  the  failing  structure.  When  puncture 
coincides  with  the  high-pressure  loading  of  the  tank  during  the  crash  sequence,  the  tearing  of  the 
fuel  tank  wall  progresses  rapidly  away  from  the  puncture  wound.  Although  the  early  CAA  work 
recognized  the  potential  danger  from  puncture  and  tear,  no  attempt  was  made  to  establish  a 
material  requirement  in  MIL-T-27422A  for  this  phenomenon,  for  the  problem  related  to  tank 
wall  strength  relative  to  the  metal  fitting  sizes  or  shapes,  or  for  the  fitting  locations  in  the  fuel 
bladder. 

The  third  shortcoming  was  the  failure  to  recognize  that  fuel  system  components,  including  the 
tanks,  are  often  subjected  to,  and  impacted  by,  aircraft  structure  that  is  being  tom  apart  and 
displaced  a  considerable  distance.  Requirements  for  tank  design  that  would  allow  for  safe 
separation  from  the  displacing,  and  sometimes  very  sharp,  structures  were  not  even  considered. 

With  the  demonstration  of  improved  materials  in  the  crash  testing  conducted  during  the  1960s 
[87],  and  with  the  development  of  new  tests  for  measuring  fuel  bladder  crash-resistant  properties, 
MIL-T-27422A  was  completely  revised.  In  addition  to  the  standard  qualification  tests  of 
noncrashworthy  fuel  tanks,  as  specified  in  MIL-T-6396  (bladder  tanks)  and  MIL-T-4478  (self¬ 
sealing  tanks),  a  draft  of  MIL-T-27422B  [88]  was  issued  containing  a  battery  of  new 
requirements  related  to  crash-resistant  fuel  bladder  testing.  These  new  requirements  included  a 
series  of  tear-resistance  tests,  followed  by  tank  drop  tests.  Both  test  series  are  worthy  of  further 
discussion  in  this  report. 

6.3.4.1  Tear  Tests. 

During  the  extensive  research  test  activities  of  the  1960s  and  1970s,  as  well  as  during  the 
concurrent  detailed  crashworthiness  fuel  system  investigations  of  aircraft  crashes,  it  became 
readily  apparent  that  the  level  of  bladder  material  tear  resistance  was  a  key  factor  in  preventing 
dangerous  fuel  spillage.  In  many  crashes,  metal  fittings  integral  to  the  bladders  would  remain 
attached  to  the  displacing  airframe  structure,  tearing  out  of  the  bladder  walls  and  thereby 
releasing  large  quantities  of  fuel.  In  addition,  bladder  punctures  that  frequently  occurred  would 
continue  to  tear  the  bladder,  especially  during  the  fluid  pressure  buildup  phase  of  the  crash 
impact.  These  tears  also  allowed  large  quantities  of  fuel  to  escape.  The  need  to  safely  retain  the 
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metal  fittings  in  the  bladder  and  the  need  to  find  a  satisfactory  solution  to  the  puncture-tear 
propagation  problem  were  key  concerns  in  establishing  the  tear-resistance  requirement.  After 
almost  10  years  of  testing,  400  ft-lbs  of  energy  was  determined  by  the  authors  of  MIL-T-27422B 
to  be  the  appropriate  constant-rate  tear  requirement  for  small-to-medium-size  aircraft*  with  fuel 
tank  quantities  of  up  to  1,000  gallons.  The  research  team  concluded  that  additional  research  in 
all  aspects  of  fuel  tank  crash  resistance  should  be  conducted  before  tanks  with  capacities 
exceeding  1,000  gallons  were  used  or  before  such  tanks  were  installed  in  thicker-skinned,  larger- 
size  aircraft. 

6.3A2  Fuel  Tank  Crash  Impact  Test. 

A  65-foot  free-fall  drop  test  was  established  by  the  researchers  and  authors  of  MIL-T-27422B 
after  almost  10  years  of  test  activity,  including  hundreds  of  actual  tests.  The  65-foot  height  was 
identified  as  the  minimum  drop  test  height  that  would  verify  the  load-carrying  capability  of  an 
unsupported  bladder  with  all  of  the  bladder  metal  fittings  installed,  and  that  would  verify  bladder 
seam  continuity  and  strength,  particularly  in  the  bladder  sidewalls.  Bladders  must  also  possess  a 
high  degree  of  cut  and  tear  resistance  to  safely  survive  the  upper  level  survivable  accident. 
These  are  key  issues  that  are  brought  into  play  when  bladders  are  required  to  bridge  gaps 
appearing  in  the  airframe  due  to  structural  displacement  associated  with  an  upper  limit 
survivable  accident  and/or  when  bladders  are  also  being  compressed  by  strong,  heavy,  and  often 
sharp  structures.  Bladders  constructed  of  highly  extendable  materials,  but  low  in  cut  and  tear 
resistance,  have  been  able  to  easily  pass  65-foot  drop  tests;  however,  if  the  bladders  contact  a 
sharp  edge  or  a  penetrative  object  while  being  distended  at  impact,  massive  fuel  spills  will  occur. 
The  failure  is  analogous  to  sticking  a  pin  in  an  inflated  balloon. 

Because  the  65-foot  drop  test  height  was  determined  to  be  the  minimum  height  required  to  verify 
necessary  bladder  strength,  no  margin  of  safety  was  built  into  the  height  of  the  drop  test.  Instead, 
a  margin  of  safety  was  obtained  by  specifying  that  the  tank  be  filled  to  100%  of  capacity  with 
water.  Because  the  weight  of  water  is  approximately  20%-25%  greater  than  the  weight  of 
aviation  fuels,  a  margin  of  safety  is  achieved.  In  many  applications,  this  margin  of  safety  for  a 
critical  item  might  appear  to  be  low,  but  given  the  track  record  that  the  CRFS  has  established 
during  the  last  25  years,  the  margin  of  safety  appears  to  have  been  appropriate. 

It  is  interesting  to  note  that  shortly  after  the  65-foot  crash  impact  test  height  was  established  as  a 
result  of  the  extensive  military  research  program,  units  of  measurement  defining  a  reasonable 
upper  level  survivable  accident  for  the  small-to-  medium-size  aircraft  were  emerging  in  the  form 
of  velocity  changes  occurring  during  the  crash  in  three  directions— vertical,  longitudinal,  and 
lateral.  The  resultant  speed,  the  speed  and  direction  actually  traveled  by  the  occupants  when  all 
three  speeds  were  combined,  often  exceeded  75  ft/sec.  However,  further  study  of  the  data 
indicated  that  the  frequency  of  occurrence  of  the  higher  velocity  accidents  was  quite  remote. 
Consequently,  a  resultant  speed  for  the  upper  level  survivable  military  accident  has  been  focused 
in  the  65  ft/sec  range. 

If  the  same  exhaustive  research  that  gave  rise  to  the  original  65-foot  drop  test  height  were 
undertaken  today,  the  drop  test  height  might  be  increased.  Today’s  military  helicopters 

An  arbitrary  selection  defining  airplanes  that  could  seat  up  to  50  occupants. 
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incorporate  many  crashworthiness  features,  including  full  CRFSs,  and  are  clearly  safer  than  were 
their  predecessors.  Seat  technology  has  been  greatly  improved,  airbag  programs  are  being 
implemented,  in  some  cases  survivable  space  is  being  enhanced,  and  other  safety  features  are 
continually  being  added.  As  a  result,  occupants  are  surviving  more  severe  crashes  today  than 
ever  before.  In  fact,  many  helicopters  crash  onto  soft  ground  containing  rocks,  stumps,  and  trees 
at  higher  longitudinal  velocities  than  the  100  ft/sec  (68  mph)  speed  referenced  in  MIL-STD- 
1290 A  and  are  still  being  considered  survivable.  An  indication  that  the  current  fuel  systems  are 
not  overdesigned  is  that  postcrash  fires  are  still  occurring  in  crashes  that  are  only  slightly  above 
the  upper  limit  survivable  accident. 


6.3.5  Self-Sealing  Breakaway  Valves. 

Fuel  and  oil  is  moved  from  one  location  to  another  within  the  aircraft  airframe  through  flexible 
and/or  rigid  hoses  or  tubes.  During  accidents  where  structural  displacement  is  great  enough, 
these  fluid-carrying  lines  are  often  pulled  beyond  their  stretching  capability,  causing  them  to 
separate  and  spill  readily  ignitable  fluid.  Spillages  due  to  this  type  of  plumbing  failure  can  be 
greatly  reduced  by  the  use  of  self-sealing  breakaway  valves  (SSBV). 

Self-sealing  breakaway  valves  are  valves  designed  to  separate  into  two  or  more  sections  and  seal 
the  open  ends  of  designated  fluid-carrying  passages.  The  openings  may  be  in  fuel/oft  lines, 
tanks,  pumps,  fittings,  etc.  The  valves  fall  into  two  general  categories,  the  frangible  type, 
which  incorporates  a  portion  that  breaks  apart,  allowing  valve  closure  and  separation  (figures  6-6 
and  6-7),  and  the  quick-disconnect  type,  which  is  installed  so  that  it  will  be  disconnected  during 
the  crash  sequence  (figure  6-8).  Some  valves  in  use  today  have  both  these  features  incorporated 
into  their  design.  Each  fuel  system  design  will  dictate  which  of  the  two  types  of  valves  can  or 
should  be  used.  In  either  case,  the  valves  must  be  installed  in  a  manner  that  precludes 
inadvertent  operation. 


Self-sealing  breakaway  valves  have  been  successfully  used  in  the  DC-9  auxiliary  fuel  system 
since  the  early  1970s.  While  figure  6-7  provides  a  simple  overview  of  the  subject  valve,  the 
reader  is  referred  to  appendix  A  of  this  report  for  more  detailed  information. 


FUEL 


FIGURE  6-6.  FRANGIBLE  TYPE  SELF-SEALING  BREAKAWAY  VALVE 
INSTALLED  AS  A  TANK  OUTLET  (These  type  valves  are  closed  and 
separated  by  displacement  of  one  of  the  valve  halves.) 
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SELF-SEALING  BREAKAWAY  SHEAR  PINS 


PULLING  THE  HOSE  SHEARS  THE  PINS,  RELEASING  THE  VALVE  HALVES 
TO  SEPARATE  SAFELY  AND  SEAL  BOTH  ENDS. 

FIGURE  6-7.  FRANGIBLE  TYPE  SELF-SEALING  BREAKAWAY  VALVE,  AS  USED 
IN  THE  FUEL  LINE  OF  SOME  CURRENT  LARGE  TRANSPORT  AIRCRAFT 

AUXILIARY  FUEL  SYSTEMS 


VALVE  RELEASE  RING 


■4 - AIRCRAFT  STRUCTURE 

INSTALLATION  SNAP  RING 


QUICK  DISCONNECT  VALVE 


PULLING  LOAD  UNCOUPLES 
QUICK  DISCONNECT 


FIGURE  6-8.  QUICK  DISCONNECT  VALVE  INSTALLED  TO  OPERATE  AS  A 
SELF-SEALING  BREAKAWAY  VALVE 


The  forces  that  are  usually  applied  to  self-sealing  breakaway  valves  to  cause  separation  and 
closure  are  transmitted  by  a  pulling  movement  of  the  flexible  fluid-carrying  hose.  As  the  hose 
stretches,  a  force  is  transmitted  to  the  valve.  If  the  force  is  great  enough,  a  component  finally 
fails.  Hopefully,  it  is  the  valve.  Unfortunately  however,  sometimes  it  is  the  other  end  of  the 
hose  or  a  hose-end  fitting.  Guidelines  to  ensure  that  the  weak  link  in  each  load-producing 
system  is  the  frangible  section  of  the  self-sealing  breakaway  valve  and  not  some  other  link  in  the 
“chain”  are  discussed  later  in  this  section. 

There  are  design  situations  where,  for  one  reason  or  another,  a  load  path  other  than  the  hose  must 
be  used.  Cable  lanyards  are  an  acceptable  alternative  load  path  technique,  and  they  are  used 
today  in  some  aircraft  installations  (figure  6-9).  If  lanyards  are  used  to  transmit  the  force  to 
cause  a  valve  to  fracture  and  separate,  they  should  be  capable  of  carrying  at  least  twice  the 
amount  of  load  it  takes  to  fracture  the  valve.  If  they  are  used  to  move  a  release  ring,  such  as  on  a 
quick-disconnect  valve  (figure  6-10),  they  should  be  at  least  twice  as  strong  as  the  force  required 
to  move  the  ring.  As  a  general  rule,  the  force  required  to  move  a  quick-disconnect  release  ring  is 
considerably  less  than  the  force  required  to  fracture  the  frangible  section  of  a  self-sealing 
breakaway  valve;  consequently,  a  lighter-weight  overall  system  can  result. 
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VALVE 


FIGURE  6-10.  CABLE  LANYARD  USED  TO  TRANSMIT  LOAD  TO  PULL 
RELEASE  RING  THAT  UNCOUPLES  QUICK-DIS CONNECT  VALVE 
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Self-sealing  breakaway  valves  should  be  located  at  each  fuel-carrying  tank  outlet  and  at  locations 
within  the  fuel  line  network  where  extensive  displacement  is  foreseeable,  such  as  tanks  mounted 
external  to  the  fuselage  or  in  engine  compartments.  The  purpose  of  these  valves  is  to  prevent 
rupture  of  the  tank,  hoses,  or  fitting  components  by  placing  a  “safety  fuse”  in  the  load  path. 

A  self-sealing  breakaway  valve  (figure  6-11)  should  be  used  to  connect  two  fuel  tanks  in  a  direct 
side-by-side  arrangement  if  there  is  a  reasonable  probability  that  structure  failure  or  displacement 
will  occur  in  the  immediate  area  of  the  tanks. 

Tank-to-line  interconnect  valves  should  be  recessed  sufficiently  into  the  tank  so  that  the  tank  half 
is  flush  with  the  tank  wall  or  protrudes  only  a  minimal  distance  beyond  the  tank  wall  after 
separation.  This  feature  reduces  the  tendency  of  the  valve  to  snag  on  adjacent  structures  during 
the  crash  sequence. 

The  frangible  interconnecting  member  of  each  of  these  valves  should  be  sufficiently  strong  to 
meet  all  operational  and  service  loads  of  the  aircraft  within  a  reasonable  margin  but  should 
separate  at  25  to  50  percent  of  the  minimum  failure  load  for  the  weakest  component  in  the  fluid- 
carrying  line.  Subsection  29.952(c)(1)  of  AC  29-2C  explains  in  detail  how  these  loads  are 
derived  and  calculated. 

Each  valve  application  should  be  analyzed  to  assure  that  the  probable  separation  load  will  be 
exerted  in  a  direction  and  manner  to  which  the  valve  is  best  suited.  These  loads,  whether 
tension,  shear,  compression,  or  combinations  thereof,  are  obtained  by  analyzing  the  aircraft  for 
probable  impact  force  and  direction  and  by  determining  the  consequent  structural  deformation 
around  the  valve.  Self-sealing  breakaway  valve  designs  should  not  allow  dangerous  spillage 
during  or  after  valve  separation.  The  valve  should  permit  no  external  leakage  when  partially 
separated. 


FIGURE  6-11.  SELF-SEALING  BREAKAWAY  VALVE  USED  AS  A 
TANK-TO-TANK  INTERCONNECT 
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For  this  reason,  valves  with  a  very  short  triggering  stroke  are  superior  to  those  with  a  long  stroke. 

Operational  pressures  are  dependent  on  specific  applications,  but  the  valve  designs  can  take 
advantage  of  the  available  line  pressure  to  assist  in  keeping  the  self-sealing  mechanism  closed. 
As  in  all  valve  designs,  light  weight  and  minimal  pressure  drop  are  major  design  objectives,  but 
the  resistance  of  the  valve  to  direct  impact  or  to  high  compressive  loads  should  not  be  sacrificed 
for  the  sake  of  weight  reduction. 

6.3.6  Fuel  Lines. 

Damaged  fuel  lines  frequently  cause  spillage  in  aircraft  accidents.  Lines  often  are  cut  by 
surrounding  structure  or  worn  through  by  chafing  rough  surfaces.  The  use  of  flexible  rubber 
hose  armored  with  a  steel-braided  harness  is  strongly  suggested  in  areas  of  anticipated  dragging 
or  structural  impingement.  In  systems  where  breakaway  valves  are  not  provided,  these 
stretchable  hoses  should  be  20  to  30  percent  longer,  before  stretching,  than  the  minimum 
required  hose  lengths.  This  will  allow  the  hose  to  shift  and  displace  with  collapsing  structure 
rather  than  be  forced  to  carry  high  tensile  loads.  The  practice  of  routing  fuel  lines  through  holes 
in  floor  beams  rather  than  attaching  the  lines  to  the  outside  of  the  beams  should  be  avoided 
because  it  greatly  restricts  the  ability  of  the  lines  to  shift  with  displacing  structure. 

For  this  reason,  it  is  equally  important  that  couplings  and  fittings  be  used  sparingly  because  of 
their  propensity  to  snag  and  restrict  the  natural  ability  of  the  hose  to  shift. 

All  fuel  lines  should  be  secured  with  breakaway  (frangible)  attachment  clips  in  areas  where 
structural  deformation  is  anticipated.  When  fuel  lines  pass  through  areas  where  extensive 
displacement  or  complete  separation  is  anticipated,  self-sealing  breakaway  valves  should  be 
used. 

All  fittings  used  in  the  fuel  system  should  meet  specific  strength  requirements  when  tested  in  the 
designated  modes.  The  loads  are  always  applied  through  the  hose  with  freedom  allowed  for  the 
hose  to  form  the  bend  radius.  Thus,  the  effective  moment  arm  for  the  bending  tests  changes 
primarily  with  the  line  size  and  secondarily  as  the  applied  load  produces  changes  in  the  bend 
radius.  This  test  procedure  is  much  easier  to  mechanize  than  one  requiring  a  constant  moment 
arm  and  is  typical  of  what  happens  in  an  actual  accident. 

In  designing  a  system  using  line-to-line  breakaway  valves,  one  should  consider  potential  hazards 
of  cross-axis  shear  loading  on  the  valve  halves.  While  omnidirectional  separation  is  not  an 
absolute  requisite  for  most  line-to-line  valves,  it  is  highly  desirable,  and  every  attempt  should  be 
made  to  procure  omnidirectional  valves  if  there  is  any  possibility  of  cross-axis  shear  loading. 

Fuel  lines  are  often  used  as  the  means  of  applying  the  loads  necessary  to  cause  self-sealing 
breakaway  valves  to  close  and  separate.  While  hose  and  end  fitting  strengths  are  discussed  in 
this  report  and  in  AC  29-2C,  it  must  be  remembered  that,  in  order  for  a  valve  to  be  pulled  apart  at 
a  predetermined  load  value,  the  structure  supporting  the  opposite  end  of  the  hose-to-valve 
connection  also  must  be  capable  of  carrying  the  load.  This  includes  bulkhead  fittings  and  fittings 
terminating  in  components  such  as  engine  fuel  controls,  filters,  and  pumps.  Failure  to  recognize 
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and  design  around  these  often  overlooked  weak  links  in  the  fuel  plumbing  system  can  negate  the 
overall  crash-resistant  design  effort. 

Fuel  line  routing  should  be  carefully  considered  during  the  design  stage.  Fuel  lines  should  be 
routed  along  the  heavier  structural  members,  since  those  members  are  less  likely  to  deform  or 
separate  in  an  accident.  Avoid  placing  fuel  lines  that  will  normally  be  carrying  fuel,  if  a  crash 
should  occur,  in  areas  of  anticipated  impact  damage,  such  as  wing  leading  edges,  the  lower 
external  skin,  and  near  the  landing  gear.  Evacuated  fuel  lines  can  be  considered  as  possible 
exceptions  to  this  rule.  Also,  it  is  important  that  hoses  have  a  space  into  which  they  can  deform 
when  necessary.  For  example,  when  hoses  pass  through  large  flat-plate  areas,  such  as  bulkheads 
or  firewalls,  the  hole  allowing  line  passage  should  be  considerably  larger  than  the  outside 
diameter  of  the  line.  Hose  stabilization  as  well  as  liquid-tight,  fire-tight  seals  still  can  be 
maintained  if  frangible  paneling  or  baffles  are  used. 

If  design  requirements  limit  the  use  of  the  protective  measures  discussed  above,  full  use  should 
be  made  of  self-sealing  breakaway  couplings  located  in  areas  of  anticipated  failures  and 
structural  displacements.  Crossover  connections,  drains,  and  outlet  lines  present  a  special 
problem  since  they  are  usually  located  in  the  lower  regions  of  the  tank,  where  they  are  vulnerable 
to  impact  damage.  Space  and  flexibility  should  be  provided  at  the  connections  to  allow  room  for 
the  lines  to  shift  with  collapsing  structure.  Utmost  consideration  should  be  given  to  using  self¬ 
sealing  breakaway  fittings  at  each  line-to-tank  attachment  point. 

6.3.7  Vent  Valves. 

Aircraft  vent  systems  can  become  a  source  of  hazardous  fuel  spillage  when  the  aircraft  remains 
upright  and  the  fuel  tank  is  compressed,  the  aircraft  rolls  far  enough  to  one  side  to  allow  fuel  to 
drain  out  of  the  vent  lines  and/or  when  the  vent  lines  fail. 

Vent  line  failure  often  occurs  at  the  point  of  exit  from  the  tank.  Failure  at  this  point  can  be 
reduced  by  using  short,  high-strength  fittings  between  the  tank  outlet  and  the  vent  line.  The  vent 
line  should  be  designed  to  assure  that  it  will  discharge  fuel  passing  through  it  away  from  the 
aircraft.  Consideration  should  be  given  to  utilizing  wire-covered  flexible  hose  routed  in  such  a 
manner  that  it  will  not  obviously  become  snagged  in  a  displacing  structure  and  tom  from  the 
tank.  Self-sealing  breakaway  valves  also  can  be  placed  at  the  tank-to-line  attachment  area.  This 
approach  becomes  mandatory  if  there  is  danger  of  the  tank  being  tom  free  of  the  supporting 
structure. 

Vent  lines  can  be  routed  inside  the  fuel  tank  in  such  a  manner  that,  if  rollover  occurs,  spillage 
cannot  continue.  This  can  be  accomplished  with  siphon  breaks  and  U-shaped  routing  and/or 
traps  in  the  line. 

Many  military  aircraft,  both  large  and  small,  incorporate  fuel  system  rollover  float/vent  valves 
inside  the  fuel  tank.  These  valves  are  designed  to  operate  in  any  attitude  and  to  allow  a  free  flow 
of  air  while  prohibiting  the  flow  of  fuel.  They  are  particularly  advantageous  during  rollover 
accidents,  and  can  be  used  in  lieu  of  flexible  lines,  breakaway  valves,  and  all  other  alternate 
considerations.  An  example  of  one  type  of  vent  valve  currently  being  used  in  both  military  and 
civilian  helicopters,  is  illustrated  in  figure  6-12. 
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If  the  fuel  system  is  to  be  pressure  refueled,  it  should  be  noted  that  a  large  bypass  system  for  tank 
overpressurization  should  be  considered.  This  capability  can  be  built  into  the  vent  valve  or  can 
be  incorporated  in  a  separate  unit.  Large  spring-loaded  pressure  relief  valves  are  in  current  use 
today.  Rollover  protection  is  provided  by  the  spring  valve,  but  tank  overpressurization  due  to 
tank  compression  causes  fuel  to  be  expelled  at  the  vent  outlet.  In  either  case,  however,  care  must 
be  taken  to  ensure  that  spillage  resulting  from  overpressurization  due  to  tank  compression  during 
a  crash  is  released  away  from  aircraft  occupants  and  the  typical  ignition  sources. 


UP 


FIGURE  6-12.  ROLLOVER  VENT  VALVE  PASSES  ADR.  BUT  CLOSES  IN  ANY 
ATTITUDE  WHEN  FUEL  TRIES  TO  ESCAPE 

6.3.8  Drain  Valves. 

Sump  drains  are  a  frequent  source  of  fuel  spillage  because  their  design  dictates  that  they  be 
located  at  the  lowest  point  in  the  tank,  in  close  proximity  to  the  most  probable  impact  area. 
Figure  6-13  illustrates  one  current  installation  that  permits  sump  drainage  without  the  sump  drain 
valve  poppet  protruding  beyond  the  face  of  the  tank. 
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FIGURE  6-13.  SUMP  DRAIN  VALVE  DESIGNED'TO  RESIST  OPENING  OR  DAMAGE 

DURING  CRASH  IMPACT 


6.3.9  Spillage  Control  Valve. 

During  the  1980s  two  different  valves  were  designed,  developed,  tested,  and  FAA  certified  for 
use  on  light  aircraft  [89],  These  valves,  installed  in  the  main  engine  fuel  line  before  it  enters  the 
engine  compartment,  were  designed  to  stop  the  flow  of  fuel  to  the  engine  area  when  the  engine  is 
not  running,  as  in  a  crash.  Normally,  when  a  fuel  or  oil  line  is  broken,  fluid  will  drain  out.  If 
this  drainage  is  in  the  engine  area,  ignition  by  the  hot  surfaces  or  other  sources  is  likely.  The  use 
of  breakaway  self-sealing  valves  of  either  the  frangible  or  quick-disconnect  type  can  stop  the 
spillage  flow,  but  they  require  displacement  and  resistive  forces  to  be  triggered  or  operated.  In 
many  small  aircraft  the  structure  is  simply  not  strong  enough  to  allow  the  creation  of  forces  great 
enough  to  operate  breakaway  valves.  The  structure  can  be  locally  reinforced,  cable  lanyards  can 
be  used,  or  both  can  be  used  if  necessary;  however,  the  approach  depicted  in  figure  6-14  uses 
neither. 


FIGURE  6-14.  SPILLAGE  CONTROL  VALVE  DESIGNED  TO  STOP  FUEL  FLOW  IF 
ENGINE  QUITS  OR  IF  DOWNSTREAM  FUEL  LINES  SEPARATE 

The  spillage  control  valve  assembly  shown  in  figure  6-14  consists  of  a  valve  body  assembly, 
pilot-pressure-operated  check  valve  components,  a  manual  by-pass  plunger,  a  manual  by-pass 
control  cable  assembly,  and  associated  seals  and  O-rings.  When  the  aircraft  engine  is  operating 
under  normal  conditions,  fuel  is  drawn  from  the  fuel  tanks  through  fuel  lines  to  the  spillage 
control  valve.  Fuel  enters  the  spillage  control  valve  assembly,  passes  through  the  internal  valve 
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components  and  exits,  passing  on  to  the  airframe-mounted  fuel  filter  and  on  to  the  engine-driven 
fuel  pump. 

When  the  aircraft  engine  is  operating  under  normal  conditions,  pilot  pressure  holds  the  valve 
open.  Statically,  when  the  aircraft  is  not  operating  and  the  engine  start  fuel  boost  pump  is  off, 
fuel  is  prevented  from  flowing  past  the  engine  firewall  by  the  spillage  control  valve  assembly.  In 
the  static  condition,  no  fuel  pressure  (pilot  pressure)  is  available  to  the  spillage  control  valve 
assembly  so  the  valve  remains  closed. 

The  FAA-certified  spillage  control  valves  require  more  than  twice  the  head  pressure  produced  by 
full  fuel  tanks,  located  as  high  above  the  valve  as  is  probable  in  an  accident,  to  open  the  poppet. 

Under  conditions  in  which  sudden  engine  stoppage  is  encountered,  i.e.,  blade  strike,  fuel  system 
line  failure,  or  foreign  object  ingestion,  the  spillage  control  valve  assembly  reacts  to  the  loss  of 
pilot  pressure  and  stops  fuel  flow.  The  condition  of  sudden  engine  stoppage  is  identical  to  the 
static  condition  of  the  system. 

Normal  starting  and  engine  operation  on  aircraft  equipped  with  the  spillage  control  valve  is  in 
accordance  with  the  normal  aircraft  procedure,  with  the  exception  that  the  manual  by-pass  lever 
of  the  spillage  control  valve  must  be  actuated  prior  to  turning  on  the  start  fuel  boost  pump.  After 
engine  start-up,  the  manual  by-pass  lever  is  returned  to  the  “Normal”  position. 

In-flight  restart  of  the  engine  is  also  in  accordance  with  the  recommended  normal  aircraft 
procedure,  except  that  the  manual  by-pass  lever  must  be  activated  prior  to  turning  on  the  start 
fuel  boost  pump.  Subsequent  to  a  successful  engine  restart,  the  manual  by-pass  lever  is  returned 
to  the  “Normal”  position. 

The  valve  is  designed  so  that  failure  of  pilot  fuel  pressure  to  reach  the  valve,  i.e.,  pilot  pressure 
line  breakage,  will  not  cause  engine  stoppage.  The  valve  is  sized  so  that  the  engine-driven  fuel 
pump  can  pull  enough  fuel  through  the  spillage  control  valve  to  obtain  the  maximum,  as  well  as 
idle,  engine  power.  Operating  with  the  valve  in  this  mode  is  similar  to  operating  in  the  by-pass 
mode  of  a  filter  or  similar  type  component.  Should  the  pilot  pressure  fuel  line  break  (rupture), 
the  resulting  spillage  can  be  prevented  or  held  to  a  minimum  by  incorporating  a  self-sealing 
breakaway  valve,  a  flow-restricting  orifice,  or  both. 

6.3.10  Nitrogen. 

Diluting  the  oxygen  laden  air  in  the  ullage  space  of  a  fuel  system  to  the  point  that  it  will  no 
longer  support  combustion  has  been  in  use  for  over  60  years.  Methods  have  included  the  use  of 
CO2,  cleaned  aircraft  engine  exhaust,  and  nitrogen. 

The  catastrophic  in-flight  explosion  of  TWA  flight  800,  a  B-747  aircraft,  has  caused  nitrogen 
inerting  to  once  again  be  seriously  considered  as  a  reasonably  practical  way  to  reduce  the 
likelihood  of  a  fire  inside  a  fuel  tank  and/or  vent  system.  Pioneered  by  the  military  as  a  means  to 
prevent  fuel  tank  explosions  following  ballistic  impacts,  it  quickly  found  its  way  into  the 
military’s  supersonic  SR-71,  YF-12,  B-70  bomber,  and  NASA’s  X-15  fuel  systems  as  a  means  of 
controlling  ullage  fires  during  heating  of  the  aircraft  caused  by  its  various  flight  profiles. 
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Studies  of  its  behavior  indicate  that  it  served  that  purpose  quite  well.  How  it  serves  to  lessen  the 
crash  fire  threat  is  unknown;  however,  when  a  midair  collision  between  the  B-70  and  an  F-104 
caused  both  aircraft  to  crash,  an  interesting  crash  observation  was  made.  It  appeared  to  the 
investigators  on  the  scene  that  the  postcrash  fire  damage,  especially  in  the  B-70  wing  area,  was 
much  less  than  they  had  anticipated,  based  on  their  observations  of  many  other  military  large 
aircraft  crashes. 

Discussions  with  the  on-scene  investigators  indicated  that  they  felt  that  the  presence  of  abundant 
nitrogen  in  the  area  served  to  reduce,  and  in  many  areas  prevent,  the  start  and/or  spread  of 
postcrash  fire.  How  successful  it  really  was  in  the  postcrash  fire  episode  is  unknown.  Although 
several  investigations  have  shown  that  fuel  tank  inerting  offers  little  or  no  protection  when  the 
fuel  tank  itself  is  ruptured,  this  might  be  an  area  worthy  of  further  research. 

6.3.11  Electrical  System. 

A  recent  study  of  nearly  all  transport  airplane  fuel  systems  [90]  disclosed  many  instances  of 
electrical  wiring  inside  fuel  tanks  which  was  chafed,  worn,  or  frayed.  Some  of  the  wires  were  in 
metal  tubes,  while  others  were  not  even  in  protective  sheathes.  While  the  study  focused  on 
issues  related  to  in-flight  fires  and  explosions,  many  of  the  observations  also  apply  to  the  crash 
scenario. 

An  energized  electrical  system  being  tom  apart  during  an  aircraft  accident  can  easily  ignite 
spilled  combustible  liquid.  While  the  scope  of  this  study  deals  primarily  with  controlling 
spillage,  it  is  worthy  of  mention  that  selective  routing  of  electrical  wiring  can  reduce  their 
likelihood  of  providing  an  ignition  source  for  the  spilled  combustible. 

6.4  ASSESSMENT  OF  CURRENT  STATUS  OF  CRFS  DESIGN. 


The  current  status  of  CRFS  design  can  be  assessed  from  three  different  aspects:  (1)  the 
importance  a  particular  item  has  in  the  overall  system;  (2)  the  technical  knowledge  available  for 
the  design  of  crash-resistant  fuel  systems  and  components;  and  (3)  the  level  of  implementation  in 
current  systems.  The  authors  of  this  report  have  attempted  to  make  this  assessment,  albeit 
arbitrarily,  from  their  perspective  of  each  having  over  35  years  of  experience  developing  CRFS 
technology.  Their  assessments  are  contained  in  table  6-1,  which  addresses  specific  CRFS 
components  for  large  transport  aircraft,  and  in  table  6-2,  which  addresses  the  correlative  factors 
which  are  necessary  for  effective  CRFS  design. 

Both  tables  list  specific  components  and/or  factors  that  must  be  considered  in  CRFS  design.  In 
table  6-1  (see  columns  A-D)  each  component  is  evaluated  with  respect  to  A — how  critical  this 
particular  component  is  in  CRTS  design;  B — how  much  knowledge  relating  to  crash  resistance  is 
available  for  component  design;  C — how  much  crash-resistance  knowledge  has  been 
implemented  in  actual  CRFS  designs;  and  D — how  many  of  the  CRFS  components  are  actually 
being  used  in  large  transport  aircraft.  In  table  6-2,  each  factor  is  evaluated  with  respect  to 
A— how  important  the  particular  factor  is  in  crash-resistant  design;  B— how  much  knowledge  is 
known  about  the  factor  which  relates  to  CRFS  design;  and  C — the  level  of  knowledge  regarding 
that  factor  which  is  currently  being  used  in  CRFS  design  for  large  transport  aircraft. 
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TABLE  6-1 .  LARGE  TRANSPORT  AIRCRAFT  CRFS  COMPONENTS 


Component 

A 

B 

C 

D 

1.1  Fuel  Tanks 

5 

Bladders 

5 

3 

2 

Integral 

2 

1 

2 

Other 

2 

1 

2 

1 .2  Fuel  Lines 

5 

Flexible 

4 

4 

3 

Rigid 

4 

3 

2 

1.3  Valves 

4 

Tank  selector 

4 

2 

2 

ON/OFF 

4 

2 

2 

Single-point  pressure  refueling 

4 

2 

2 

Check 

5 

3 

3 

Drain 

5 

3 

3 

Vent 

5 

1 

3 

1 .4  Couplings 

5 

Self-sealing  (quick  disconnect) 

5 

2 

1 

Self-sealing,  breakaway  (quick  disconnect) 

4 

1 

1 

Self-sealing,  breakaway  (frangible) 

5 

3 

2 

AN/MS  Plumbing 

4 

3 

3 

Nipples 

2 

1 

1 

1 .5  Miscellaneous  Components 

5 

Pumps 

4 

3 

2 

Filler  openings 

5 

3 

2 

Filler  caps 

5 

3 

2 

Filters 

3 

3 

2 

Frangible  fasteners 

5 

3 

1 

Fuel  Quantity  sensor 

5 

3 

2 

A  =  Level  of  crash-resistance  importance 

B  =  Level  of  crash-resistance  knowledge  available  for  component  design 
C  =  Level  of  crash-resistance  knowledge  integrated  into  component  design 
D  =  Level  of  CRFS  component  use  in  large  transport  aircraft 

5  =  Best/highest 
1  =  Worst/lowest 
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TABLE  6-2.  FACTORS  AFFECTING  LARGE  TRANSPORT  AIRCRAFT  CRFS  DESIGN 


Factor 

A 

B 

C 

1 . 1  Level  of  Crash  Severity  Desired 

5 

Human  tolerance 

5 

4 

1 .2  Crash  Environment  at  the  Severity  Level 

c 

Selected 

5 

Velocity  changes  at  impact 

2 

2 

Structural  behavior  at  impact 

2 

2 

Impact  attitudes  and  angles 

2 

2 

1 .3  Fuel  System  Behavior 

5 

Probable  fuel  spillages 

3 

2 

Probable  ignition  sources 

3 

3 

1 .4  Fuel  Characteristics 

4 

Typical  liquid  fuels 

5 

4 

Modified  fuels 

2 

1 

1.5  CRFS  Standards 

5 

FAR’s 

2 

5 

SAE/DOD 

3 

2 

Design  Guides 

4 

3 

Advisory  Circulars 

4 

4 

1 .6  Quality  and  Quantity  of  Accident  Data 

5 

Investigator  competence 

2 

2 

Investigator  training 

2 

2 

Data  storage 

2 

3 

Data  retrieval 

2 

3 

Feedback 

2 

2 

A  =  Level  of  crash-resistance  importance 
B  =  Level  of  knowledge  related  to  crash-resistance  issues 
C  =  Level  of  knowledge  being  applied 

5  =  Best/highest 
1  =  Worst/lowest 

Each  component  or  factor  is  rated  in  all  areas  on  a  scale  from  1  to  5,  with  1  being  the  worst  or 
lowest  level  and  5  being  the  best  or  most  important.  For  instance,  a  5  in  column  A  of  both  tables 
signifies  that  this  component  or  factor  is  of  primary  importance  in  CRFS  design  while  a  1  means 
that  the  component  or  factor  should  be  considered  but  does  not  take  precedence  over  other 
considerations  in  CRFS  design.  A  5  in  column  B  of  table  6-1  means  that  the  knowledge  to 
design  a  particular  crash-resistant  component  is  extensive  and  complete,  in  column  C  that  the 
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component  is  very  well  designed  for  crash  resistance,  or,  in  column  D,  that  this  particular 
component,  in  a  highly  crash-resistant  configuration,  is  being  extensively  used  in  current  large 
transport  aircraft.  Likewise,  a  rating  of  1  in  column  B  of  table  6-2  means  that  very  little 
is  known  about  the  factor  or  that  the  knowledge  is  unsatisfactory  for  CRFS  design.  A  1  in 
column  C  of  table  6-2  indicates  that  this  factor  is  not  being  used  effectively  to  any  extent  in 
CRFS  design. 

Tables  6-1  and  6-2  provide  a  general  idea  of  areas  where  future  research  is  most  necessary  and 
where  the  implementation  of  crash-resistant  hardware  and/or  airframe  design  is  most  lacking.  To 
use  the  tables  for  prioritizing  or  selecting  research  and/or  design  projects,  the  level  of  importance 
should  be  of  the  highest  order  (e.g.,  a  rating  of  5  in  column  A).  Then,  for  whichever  major 
component  or  factor  is  selected,  the  lowest  number  under  column  B  indicates  where  more 
research  is  needed.  The  lowest  number  in  column  C  signifies  the  lowest  implementation  or 
application  of  the  factor.  A  low  number  here  indicates  a  need  for  design  and/or  implementation 
of  a  CRFS  component  (table  6-1)  or  better  utilization  of  available  knowledge  in  CRFS  design 
(table  6-2). 

In  examining  table  6-1,  several  general  trends  are  apparent.  Perhaps  the  most  noticeable  is  that 
all  but  one  of  the  general  component  areas  have  the  highest  level  of  importance  (5  in  column  A). 
This  reflects  the  fact  that  a  CRFS  must  work  as  a  complete  system.  It  is  only  as  effective  as  its 
weakest  link.  Also  apparent,  with  only  a  few  exceptions,  is  that  the  basic  knowledge  for  CRFS 
component  design  and  implementation  is  well  advanced.  One  notable  exception  is  the  lack  of 
CRFS  knowledge  and  technology  to  incorporate  crash  resistance  into  current  integral  fuel  tanks. 

The  lower  ratings  in  column  C  of  table  6-1  indicate  components  incorporating  little,  if  any, 
special  crash-resistant  features  in  their  design.  Some  components  can  be  made  more  crash 
resistant  by  making  them  sturdier  or  redesigning  them  to  reduce  their  overall  vulnerability.  The 
latter  is  usually  better,  especially  if  weight  is  a  concern.  In  the  case  of  fuel  tanks,  bladders  have 
shown  to  be  more  crash  resistant  than  other  fuel  containment  concepts  thus  far  developed. 

In  table  6-2  the  level  of  knowledge  (column  B),  as  well  as  utilization  of  that  knowledge 
(column  C)  is  shown.  Much  of  the  discrepancy  between  column  A  and  B  is  due  to  the  lack  of 
adequate  crashworthiness  accident  investigations,  investigative  procedures  and  accident  data 
storage  and  retrieval.  This  issue  is  discussed  at  length  in  section  4  of  this  report. 

The  predominant  criterion  for  manufacturers  and  designers  is  the  level  of  crash  severity  that  must 
be  accommodated  by  the  CRFS.  Since  the  principal  objective  of  the  CRFS  is  to  protect  the 
aircraft  occupants  from  fire  in  accidents  that  approach  the  limits  of  survivability  due  to  impact 
forces,  the  crash  environment  must  be  well  understood  in  order  to  establish  the  severity  level  for 
CRFS  design. 
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7.  FUEL  SYSTEM  CRASH  SURVIVABILITY  EVALUATION. 


7.1  POSTCRASH  FIRE  POTENTIAL  RATING  SYSTEM. 

The  Aircraft  Crash  Survivability  Evaluation  process  that  is  part  of  Aeronautical  Design  Standard 
(ADS)-llB  [91]  is  designed  to  numerically  relate  the  crash  survival  potential  of  a  particular 
aircraft  design  to  what  is  considered  optimum  for  each  specific  issue  to  be  rated,  e.g.,  the  fuel 
system.  Throughout  the  past  30  years,  the  rating  system  has  been  highly  reliable  in  pinpointing 
potential  crash  survivability  problem  areas.  This  section  paraphrases  in  substantial  part,  the 
contents  of  ADS-1  IB. 

Although  ADS-1  IB  is  part  of  the  U.S.  Army’s  Survivability  Program  for  Rotary  Wing  Aircraft, 
the  Crash  Survivability  Evaluation  process  is  applicable  to  all  aircraft,  fixed  wing  as  well  as 
rotary  wing.  The  numerical  ratings,  derived  primarily  from  accident  data,  are  valid  for  both 
helicopter  and  small  fixed-wing  aircraft,  but  would  probably  be  different  for  large  transport 
category  aircraft.  The  process,  however,  is  a  valuable  tool  for  fuel  system  designers  and,  as 
such,  is  included  in  this  report.  When  the  quality  of  accident  data  for  transport  aircraft  is 
improved,  the  evaluation  items  and  the  point  system  can  be  adjusted  accordingly. 

The  primary  objective  of  the  evaluation  process  is  to  provide  a  tool  for  use  during  the 
preliminary  design  phase  of  new  aircraft  or  for  modification  to  existing  aircraft.  These  early 
evaluations  identify  problem  areas  in  sufficient  time  to  accomplish  design  changes  with  a 
minimum  cost  in  time  and  dollars. 

The  Aircraft  Crash  Survivability  Evaluation  is  based  on  the  probable  performance  of  an  aircraft 
in  an  upper  limit  survivable  crash,  since  it  is  assumed  that  protection  of  the  occupants  to  their 
upper  limits  of  human  survivability  is  the  major  goal  in  aircraft  crashworthiness  design. 

When  evaluating  any  aircraft  from  a  crash  survival  point  of  view  there  are  six  basic  factors  that 
must  be  considered.  They  are: 

1 .  Crew  Retention  System, 

2.  Passenger  Retention  System, 

3.  Postcrash  Fire  Potential, 

4.  Basic  Airframe  Crashworthiness, 

5.  Evacuation,  and 

6.  Injurious  Environment. 

In  order  to  develop  a  reasonable  Crash  Survivability  Rating,  weighted  values  have  been  assigned 
to  the  various  factors.  The  percent  of  weight  assigned  to  each  is  based  on  their  relative  hazard 
potential.  The  six  factors  with  their  hazard  potential  for  small  aircraft  are  shown  in  table  7-1. 
Although  the  relative  crew/passenger  retention  system  ratings  are  probably  inaccurate  for 
transport  airplanes,  accident  data  to  date  seem  to  show  that  the  postcrash  fire  hazard  does 
account  for  about  one-third  of  the  total  crash  hazard.  It  is  not  unrealistic  to  think  that  the  overall 
retention  system  (crew  plus  passenger)  could  also  account  for  approximately  one-third  of  the 
total. 
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When  performing  the  rating  for  small  aircraft,  the  hazard  potential  percentage  has  been 
converted  to  an  optimum  point  value  where  a  perfect  score  on  all  six  factors  would  equal  720. 
For  existing  aircraft  not  incorporating  a  crashworthy  fuel  system,  inadequate  restraint  systems 
and  postcrash  fire  have  been  equally  responsible  for  injuries  and  fatalities  in  accidents  so  they 
were  weighted  at  approximately  35%  each.  A  poor  score  on  either  of  these  important  items 
indicates  a  critical  situation  from  a  crash  survival  point  of  view  —  depending  on  such  variables  as 
number  of  occupants  carried,  operating  terrain,  and  rescue  facilities. 


TABLE  7-1.  AIRCRAFT  SURVIVABILITY  HAZARD  RATING  FOR 
HELICOPTERS  AND  SMALL  AIRPLANES 


Hazard 

Potential 

Optimum 

Points 

1 .  Crew  Retention  System 

17.9% 

125 

2.  Passenger  Retention  System 

17.2% 

125 

3.  Postcrash  Fire  Potential 

35.2% 

255 

4.  Basic  Airframe  Crashworthiness 

17.2% 

125 

5.  Evacuation 

8.3% 

60 

6.  Injurious  Environment 

4.2% 

30 

Totals 

100% 

720 

Each  of  the  six  factors  is  in  turn  broken  down  into  subfactors  against  which  a  hazard  potential 
percentage  has  been  assigned  and  converted  to  an  optimum  point  value.  The  evaluator  selects 
that  portion  of  the  optimum  point  value  that  each  subfactor  is  worth  and  lists  it  accordingly.  The 
criteria  for  the  Postcrash  Fire  Potential  Rating  subfactors  are  listed  in  table  7-2  and  discussed 
briefly  on  the  following  pages.  When  rating  an  aircraft,  the  subfactors  are  given  a  point  value 
proportional  to  the  desirable  qualities  outlined  in  this  discussion. 

7.1.1  Spillage  Control. 

7- 1.1.1  Fuel  Containment  (Optimum  =  60  points'). 

a.  Location  (20%  of  total  value)  -  12  points 

The  location  of  the  fuel  tank  should  be  evaluated  with  respect  to  the  anticipated  impact 
area,  occupiable  area,  large  weight  masses,  and  primary  ignition  sources. 

b.  Vulnerability  (20%  of  total  value)  -  1 2  points 

The  vulnerability  of  a  fuel  tank  should  be  evaluated  with  respect  to  possible  tank  ruptures 
caused  by  various  aircraft  structural  failures,  such  as  landing  gear  failure  and  vertical 
column  deflection.  Tank  failures  associated  with  structural  displacement,  such  as 
ruptures  around  the  filler  neck,  the  fuel  line  entry  and  exit  area,  the  quantity  indicators, 
and  the  tiedown  devices  should  also  be  considered. 
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TABLE  7-2.  POSTCRASH  FIRE  POTENTIAL  RATING  FOR  HELICOPTERS  AND 

LIGHT  AIRPLANES 


Optimum 

Points 

Actual 

Points 

Spillage  Control 

Fuel  containment 

60* 

Oil  containment 

Flammable  fluid  lines 

Firewall 

9 

Fuel  flow  interrupters 

9 

Ignition  Control 

Induction  and  exhaust  flame  location 

30 

Location  of  hot  metals  and  shielding 

30 

Engine  location  and  tiedown  strength 

15 

Battery  location  and  tiedown  strength 

12 

Electrical  wire  routing 

12 

Boost  pump  location  and  tiedown  strength 

7 

Inverter  location  and  tiedown  strength 

6 

Generator  location  and  tiedown  strength 

6 

Lights  location  and  tiedown  strength 

5 

Antenna  location  and  tiedown  strength 

.  4 

Total  Points 

255 

*  If  a  range  extension  system  is  included  in  the  evaluation,  allow  40  points  for  primary  fuel  system  and  20 
points  for  the  range  extension  system. 


c.  Construction  Technique  (50%  of  total  value)  —  30  points 

The  construction  technique  is  evaluated  for  two  primary  considerations.  One  is  tank 
geometry  and  the  other  is  tank  construction  materials. 

•  Tank  Geometry 

Smooth  contoured  shapes  are  given  the  highest  number  of  points,  whereas 
irregular  shapes  and  interconnected  multicell  tanks  are  given  the  lowest  number 
of  points. 

•  Cell  Material 

The  tank  is  given  a  certain  number  of  points,  depending  on  its  construction. 

Crash  Resistant  per  MIL-T-27422B  30  points 
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Crash  Resistant  per  MIL-T-5578C  1 2  points 

dated  26  July  1983* 

Metal  Canister  6  points 

Integral  3  points 

d.  Fuel  Boost  System  (10%  of  total  value)  -  6  points 

The  fuel  boost  pump  should  be  evaluated  according  to  its  potential  for  causing  fuel 
spillage  due  to  fuel  cell  rupture  or  line  failure.  This  includes  location  and  method  of  fuel 
cell  attachment. 

7.1.1 .2  Oil  and  Hydraulic  Fluid  Containment  (Optimum  =  20  points!. 

a.  Location  (34%  of  total  value)  -  7  points 

The  location  of  the  oil  tank  should  be  evaluated  from  the  standpoint  of  its  proximity  to 
the  anticipated  impact  area,  occupiable  area,  large  weight  masses,  and  primary  ignition 
sources. 

b.  Vulnerability  (34%  of  total  value)  -  7  points 

Evaluate  from  the  standpoint  of  rupture  resistance  from  other  aircraft  structure;  e.g., 
control  linkage  failures  causing  puncture  to  the  tank. 

c.  Construction  and  Tiedown  Adequacy  (32%  of  total  value)  -  6  points 

•  Construction  Methods 

Construction  methods  are  evaluated  in  descending  order  of  oil-containing  ability. 

Cellular  6  points 

Bladder  4  points 

Sheet  Metal  2  points 

•  Tiedown  Adequacy 

Tiedown  should  be  evaluated  primarily  on  the  adequacy  of  the  system  to  safely 
support  the  tank  during  typical  crash  accelerations. 


MIL-T-5578  deals  with  self-sealing  characteristics  of  fuel  tanks  when  subjected  to  various  caliber  projectiles,  and 
does  NOT  address  crash  resistance  directly. 
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7. 1 . 1 .3  Flammable  Fluid  Lines  (Optimum  =  30  points). 

a.  Construction  (33%  of  total  value)  —  10  points 

The  construction  of  fuel  lines  should  be  judged  in  accordance  with  the  hose  material  and 
couplings.  Experience  has  shown  that  rigid  lines  fail  before  the  flexible  type;  thus, 
flexible  lines  with  a  steel-braided  outer  sheath  are  given  the  most  points.  Also  included 
in  this  phase  of  the  evaluation  are  the  couplings.  The  fewer  the  couplings  the  better. 
Ninety-degree  couplings  are  less  desirable  than  the  straight  type.  Any  coupling  is  less 
desirable  than  an  uncut  hose.  Aluminum  fittings  usually  fail  before  steel  ones. 

b.  Routing  (33%  of  total  value)  -  10  points 

The  routing  of  the  fuel  lines  is  an  important  consideration.  The  lines  must  not  pass 
through  areas  where  they  can  get  trapped,  cut,  or  pulled.  Extra  hose  length  (20%-30%  in 
areas  of  anticipated  structural  deformation)  should  be  provided.  Holes  through  which  the 
fuel  lines  pass  should  be  considerably  larger  than  the  outer  diameter  of  the  hose. 

c.  Breakaway  Fittings  (33%  of  total  value)  -  10  points 

Breakaway  fittings  or  self-sealing  breakaway  valves  should  be  installed  on  each  fuel  line 
that  enters  and  exits  the  fuel  tank.  It  is  also  advisable  to  have  them  installed  at  strategic 
locations  throughout  the  system. 

7. 1.1. 4  Firewall  (Optimum  -  9  points). 

Evaluate  the  firewall  from  the  standpoint  of  how  well  it  will  function  as  a  shield  between  crash- 
induced  fluid  spillage  and  the  various  engine  ignition  sources. 

7.1.1 .5  Fuel  Flow  Interrupters  (Optimum  =  9  points). 

Fuel  flow  interrupters  are  devices  that  block  or  divert  the  flow  of  spilled  flammable  fluids. 
There  are  many  different  methods  to  perform  this  function,  including  baffles,  drain  holes,  drip 
fences,  and  curtains. 

7.1.2  Ignition  Control. 

7. 1 .2. 1  Induction  and  Exhaust  Flame  Location  (Optimum  =  30  points). 

Evaluate  from  the  standpoint  of: 

a.  Location  of  expelled  flames  in  relation  to  location  of  spilled  flammable  liquids. 

b.  Fuel  ingestion. 
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7. 1.2.2  Location  of  Hot  Metals  and  Shielding  (Optimum  =  30  points'). 


Evaluate  from  the  standpoint  of  how  well  the  hot  items  (temperatures  above  400°F)  are  shielded 
or  protected  from  fuel  spillage.  Components  included  are: 

a.  Engine  (external  and  internal) 

b.  Exhaust  system 

c.  Heater 

d.  APU 

7. 1.2.3  Engine  Location  and  Tiedown  Strength  (Optimum  =  15  points!. 

Consider  sequences  of  engine  separation.  Where  will  the  engine  go  and  how  will  it  affect  the 
fuel  cell,  exhaust  system,  electrical  wiring,  and  fuel  and  oil  lines?  Will  the  engine  come  into 
contact  with  spilled  flammable  fluids? 

Retention  strength  is  more  important  for  aircraft  in  which  the  engine  may  be  located  above  or 
just  behind  the  fuel  cell;  it  is  of  less  consequence  for  pod-mounted  engines. 

7.1 .2.4  Battery  Location  and  Tiedown  Strength  (Optimum  =  12  points'). 

Evaluate  from  the  standpoint  of  tiedown  strength  and  of  vulnerability  of  the  battery  and  attached 
wiring  to  damage  during  a  crash.  Location  should  also  be  as  far  as  possible  from  fuel  and  oil 
tanks  and  anticipated  areas  of  flammable  fluid  spillage. 

7.1.2.5  Electrical  Wire  Routing  (Optimum  =  12  points!. 

Evaluate  from  the  standpoint  of  crashworthiness  of  routing  and  vulnerability  to  damage  during 
crash.  Some  excess  length  (20%-30%)  should  be  provided  to  allow  for  airframe  deformation 
during  a  crash. 

7. 1.2.6  Fuel  Boost  System  (Optimum  =  7  points). 

The  fuel  boost  system  should  be  evaluated  with  respect  to  its  function  as  an  ignition  source.  The 
following  items  should  be  considered: 

a.  Power  Supply.  (An  air-driven  pump  is  best,  a  hydraulic-driven  pump  is  next  best,  and  an 
electrically  driven  pump  is  least  desirable.) 

b.  Pump  Location.  (A  suction  system  with  the  pump  located  on  the  engine  is  best.  A  pump 
located  outside  the  tank  is  next  best  and  an  internal  tank-mounted  pump  is  least 
desirable.) 
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7. 1.2.7  Inverter  Location  and  Tiedown  Strength  (Optimum  =  6  points). 

Evaluate  from  the  standpoint  of  tiedown  strength  and  of  vulnerability  of  the  inverter  and  attached 
wiring  to  damage  during  crash.  Location  should  be  as  far  as  possible  from  fuel  and  oil  tanks  and 
anticipated  areas  of  flammable  fluid  spillage. 

7. 1.2.8  Generator  Location  and  Tiedown  Strength  ('Optimum  =  6  points). 

Evaluate  from  the  standpoint  of  tiedown  strength  and  of  vulnerability  of  the  generator  and 
attached  wiring  to  damage  during  a  crash.  Location  should  be  as  far  as  possible  from  fuel  and  oil 
tanks  and  anticipated  areas  of  flammable  fluid  spillage. 

7. 1.2.9  Lights  (Beacons.  Search,  and  Navigation)  ('Optimum  =  5  points). 

Are  the  light  filament  and/or  wires  immediately  surrounding  the  light  attachments  in  the  area  of 
possible  flammable  fluid  spillage? 

7.1.2.10  Antenna  Location  (Optimum  =  4  points). 

Evaluate  the  antenna  systems  and  their  respective  wiring  from  the  standpoint  of  vulnerability  to 
damage  and  location  in  the  areas  of  possible  flammable  fluid  spillage. 

7.2  FUEL  SYSTEM  FIRE  HAZARD  LEVEL  REDUCTION. 

The  previous  section  discussed  the  postcrash  fire  survivability  factors  and  ratings  criteria  for 
aircraft  fuel  and  electrical  systems.  This  section  presents  a  more  detailed  postcrash  fire 
evaluation  based  on  a  rating  system  that  has  been  used  to  determine  the  percent  of  the  total  fire 
hazard  attributable  to  selected  fuel  system  components  overall  and/or  for  a  specific  damage- 
prone  area  containing  potentially  hazardous  fuel  system  components  [92].  An  example  of  an 
overall  components  evaluation  in  a  hypothetical  transport  airplane  fuel  system  is  included  to 
illustrate  how  the  evaluation  process  is  used  to  reduce  the  fire  hazard  level  of  the  fuel  system. 

7.2.1  Evaluation  Criteria  and  Process. 


7.2. 1.1  General. 

Now  that  truly  crash-resistant  fuel  system  knowledge  exists  and,  in  fact,  is  installed  in  most  U.S. 
military  helicopters,  and  crashworthy  hardware  is  available  from  many  aerospace  manufacturers, 
the  fuel  system  designer  is  confronted  with  the  problem  of  trying  to  determine  how  much  fire 
safety  can  (or  should)  be  included  in  any  given  aircraft  type,  size,  or  fuel  system  design.  An 
evaluation  technique  has  been  developed  which  allows  a  fuel  system  design  to  be  evaluated  to 
determine  the  relative  fire  hazard  level  for  each  component  and/or  hazardous  area.  Proposed 
crashworthy  design  changes  can  then  be  integrated  into  the  original  design  and  the  system  re¬ 
evaluated  to  determine  the  fire  hazard  level  reduction.  This  process  allows  the  designer  to  make 
intelligent  trade-offs,  when  necessary,  in  the  fuel  system  design  to  achieve  the  desired  reduction 
in  the  postcrash  fire  hazard. 
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For  the  evaluation  to  be  performed,  several  assumptions  must  be  made  to  establish  a  baseline  or 

starting  point.  They  are 

a.  The  only  fire  threat  being  evaluated  is  the  one  from  the  fuel  system.  (The  cargo,  oils, 
etc.,  are  not  included  in  this  evaluation,  although  they,  too,  could  be  evaluated  if  they 
were  included  in  the  evaluation  process.) 

b.  The  fire  threat  associated  with  the  original  fuel  system  is  the  basis  from  which  the  fuel 
system  improvements  are  to  be  measured.  As  an  example,  the  overall  fire  threat 
associated  with  the  original  fuel  system  is  assumed  to  be  100%.  Improvements  in  fuel 
system  design  are  measured  in  percentage  of  reduction  from  the  original  100%  fire 
hazard  level. 

c.  In  order  to  evaluate  the  behavior  of  various  fuel  system  designs,  a  crash  environment  that 
is  typical  of  the  serious,  marginally  survivable  accident  should  be  used  as  the  basic 
reference  point. 

d.  The  evaluator  must  be  skilled  in  accident  investigation  and  reconstruction,  fuel  system 
design,  aircraft  and  aircraft  systems  behavior  during  crash  situations,  and  crash-resistant 
design. 

The  evaluation  process  is  performed  in  the  following  manner: 

a.  The  original  fuel  system  is  defined,  and  the  various  component  and/or  hazardous  areas 
are  noted,  as  shown  in  figure  7-1  and  in  table  7-3. 

b.  Each  identified  component  or  hazardous  area  in  the  original  fuel  system  is  evaluated  in 
accordance  with  the  rating  system  (defined  below)  to  determine  its  relative  fire  hazard 
level. 

c.  The  original  fuel  system  design  is  modified  to  incorporate  various  crashworthy  hardware 
and/or  design  changes,  and  then  re-evaluated  in  accordance  with  the  rating  system  to 
determine  the  fire  hazard  level  reductions  attributable  to  the  improved  design. 

Note.  The  original  fuel  system  may  be  upgraded  by  the  addition  of  only  one  crashworthy 
improvement  or  by  the  addition  of  many  crashworthy  improvements.  Each  upgraded 
system  must  be  evaluated  as  a  complete  system  to  determine  the  fire  hazard  level 
reduction  attributable  to  separate  design  changes.  The  reason  for  the  complete  re- 
evaluation  of  each  upgraded  system  is  that  the  changing  of  one  or  more  components 
and/or  hazardous  areas  can,  and  usually  does,  influence  the  behavior  of  the  remaining 
components  and/or  hazardous  areas. 
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A  -  Wing  Tanks 
B  -  Center  Wing  Tank  Zone 
C  -  Under  Floor  Zone,  Except  B 
D  -  Engine  Zone 
E  -  Main  Landing  Gear  Zone 


FIGURE  7-1 .  HYPOTHETICAL  TRANSPORT  AIRPLANE  FUEL  SYSTEM  WITH  THE 
COMPONENTS  AND  HAZARDOUS  AREAS  IDENTIFIED 


TABLE  7-3.  SAMPLE  HYPOTHETICAL  FUEL  SYSTEM  FIRE  HAZARD  LEVEL- 

UNMODIFIED  ORIGINAL 


Item 

Description 

Percent 

FCS1 

Percent 

LSCF2 

Points 

FSOF3 

Points 

EET4 

Hazard 

Units5 

Fire 

Hazard 

Level6 

Percent 

Hazard 

Reduction7 

1 

Filler  openings 

50 

50 

8 

8 

4.00 

5.45 

N/A 

2 

Tanks 

50 

80 

10 

10 

8.00 

10.90 

N/A 

3 

Outlets 

90 

90 

10 

10 

16.20 

22.07 

N/A 

4 

Fuel  lines  (tank-to- 
tank) 

50 

90 

10 

10 

9.00 

12.26 

N/A 

5 

Fuel  lines  (tank-to- 
engine) 

80 

30 

8 

8 

3.84 

5.23 

N/A 

6 

Valves  (selector) 

80 

75 

10 

7 

10.20 

13.90 

N/A 

7 

Valves  (firewall 
shutoff) 

75 

75 

10 

7 

9.56 

13.02 

N/A 

8 

Filters 

20 

75 

10 

6 

2.40 

3.27 

N/A 

9 

Pumps 

80 

75 

10 

7 

10.20 

13.90 

N/A 

Totals 

73.4 

100.0 

Notes: 


1 .  FCS  -  Likelihood  of  a  component  to  fail  and  cause 
spillage 

2.  LSCF  =  Likelihood  of  spillage  catching  fire 

3.  FSOF  =  Likelihood  of  fire  starting  other  fires 

4  =  Numeric  code  representing  estimated  escape  time 

for  occupants 

5.  Hazard  Units  =  (FCS/100  x  LSCF/100)  x  (FSOF  +  EET) 


6.  Fire  Flazard  Level  = 

Hazard  Units  (by  item)  x  100 
Hazard  Units  (total  unmodified) 

7.  Percent  Fire  Hazard  Reduction  = 

Basic  Hazard  Level  -  Modified  Hazard  Level  x  100 
Basic  Hazard  Level 


7.2, 1 2  The  Rating  System. 

The  rating  system  evaluates  the  following  four  items: 

a.  The  likelihood  of  fuel  spillage  occurring  from  the  designated  components  and/or 
hazardous  areas  during  the  serious,  marginally  survivable  crash. 

b.  The  likelihood  of  fuel  spillage  from  the  designated  component/area  catching  fire. 

c.  The  likelihood  of  an  existing  fire  that  started  at  a  designated  component/area  functioning 
as  an  ignition  source  for  other  probable  spillages  in  other  designated  areas.  (The  chain 
reaction  situation.) 

d.  The  probable  escape  time  available  to  occupants  if  a  fire  occurs  at  a  designated 
component/area. 
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7.2. 1.2.1  Failure  of  a  Component  Which  Causes  Spillage. 


When  rating  the  fuel  system  components  and/or  hazardous  areas  for  the  likelihood  of  fuel 
spillage  during  the  serious,  marginally  survivable  crash,  the  following  items  should  be  included 
in  the  evaluation: 

a.  Vulnerability  of  the  component  and/or  area  during  impact. 

•  Location 

•  Specific  component  or  area  design 

b.  Probability  that  a  destructive  impact  will  occur.  Each  designated  component/area  is  rated 
in  each  specific  system  configuration.  The  rating  is  given  in  the  form  of  percentage  of 
probable  spillage  occurrence.  Example:  If  the  designated  component/area  will  cause 
spillage  during  every  serious  crash,  it  is  given  a  100%  rating,  whereas  if  it  will  cause 
spillage  in  only  one  out  of  every  four  accidents,  it  is  given  a  rating  of  25%. 

7.2.1 .2.2  Likelihood  of  Spillage  Catching  Fire. 

When  rating  the  fuel  system  components  and/or  hazardous  areas  for  the  likelihood  of  fuel 
spillage  catching  fire,  the  following  items  should  be  included  in  the  evaluation. 

a.  Availability  of  ignition  sources 

•  Type 

•  Available  energy  and  duration 

•  Location 

b.  Size  of  fuel  spill 

c.  Probable  spillage  paths 

Spillage  occurring  at  each  designated  component/area  is  rated  in  each  specific  system 
configuration.  The  rating  is  given  in  the  form  of  percentages  of  probable  ignition. 

Example:  If  the  spillage  will  catch  fire  every  time  during  the  serious  crash  environment,  it  is 
given  a  1 00%  rating.  If  it  will  ignite  in  only  one  out  of  every  four  accidents,  it  is  given  a  rating 
of  25%. 

7.2.1 .2.3  Fire  Starting  Other  Fires. 

When  rating  the  fuel  system  components  and/or  hazardous  areas  for  the  likelihood  of  an  existing 
fire  serving  as  an  ignition  source  for  other  spillages,  the  following  items  should  be  included  in 
the  evaluation: 

a.  Location  of  fire 

b.  Size  of  fire 

c.  Location  of  other  ignitable  material 

d.  Possible  spillage  paths 

e.  Possible  flame  spread  paths 
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Each  fire  is  rated  in  each  specific  system  configuration.  The  rating  is  given  in  the  form  of  points. 
If  an  existing  fire  is  90%  to  100%  likely  to  ignite  surrounding  spillages,  a  rating  of  10  is  given. 
If  the  likelihood  of  an  ignition  chain  reaction  is  80%  to  90%,  a  rating  of  9  is  given.  The  point 
rating  decreases  at  the  rate  of  1  point  per  each  10%  decrease  in  likelihood  of  occurrence,  as 
shown  below. 


Likelihood  of  Fire 
Starting  Other  Fires 
Rating  Points 

10 

9 

8 

7 

6 

5 

4 

3 

2 

1 

7.2. 1.2.4  Estimated  Escape  Time- 


Reaction  Occurrence 

90-  100% 

80  -  90% 

70  -  80% 

60  -  70% 

50  -  60% 

40  -  50% 

30  -  40% 

20  -  30% 
10-20% 
0-10% 


When  rating  the  fuel  system  components  and/or  hazardous  areas  for  the  probable  escape  time 
available  to  occupants  if  a  fire  occurs,  the  following  items  should  be  included  in  the  evaluation: 


a.  Location  of  initial  fire  relative  to  the  occupants 

b.  Growth  potential  of  the  fire 

•  Initial  spillage  quantity 

•  Sustained  spillage  quantity 

c.  Egress  considerations 

•  Location  of  occupants  relative  to  the  escape  routes 

•  Complexity  of  the  escape  (doors,  hatches,  handles,  cargo,  and  other  potentially 
delaying  problems) 

Each  fire  is  rated  in  each  specific  system  configuration.  The  rating  is  given  in  the  form  of  points. 
If  the  escape  time  is  estimated  to  be  less  than  20  seconds,  the  fire  is  given  a  rating  of  10.  If  the 
escape  time  is  more  than  20  seconds,  but  less  than  40  seconds,  the  fire  is  rated  9.  The  point 
rating  decreases  at  the  rate  of  1  point  for  each  20  second  increase  in  escape  time  as  shown  below. 
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Rating  Points 


Available  Escape  Time 


10 
9 
8 
7 
6 
5 
4 
3 
2 
1 

For  a  discussion  of  why  180  seconds  is  chosen  as  the  maximum  time  duration,  see  Escape  Time 

Discussion,  section  7.2. 1.3. 

7.2. 1.2.5  Hazard  Units. 

Hazard  units  are  arbitrary  numbers  derived  by  the  following  formula. 

(FCS/100  x  LSCF/100)  x  (FSOF  +  EET) 

Rating  in  percent  for  each  component/area  when  evaluated  for  the  likelihood  of  the 
component  “failing  and  causing  spillage.” 

Rating  in  percent  for  each  component/area  when  evaluated  for  the  “likelihood  of  the 
spillage  catching  fire.” 

Rating  in  points  for  each  fire  when  evaluated  for  the  likelihood  of  “fire  starting  other 
fires.” 

Rating  in  points  for  each  fire  when  evaluated  for  “estimated  escape  time”  for 
occupants. 

7.2. 1.2.6  Fire  Hazard  Level. 

The  fire  hazard  level  is  100%  for  the  complete,  original  fuel  system  design.  For  a  specific 

component  and/or  designated  area  it  is  derived  by  the  following  formula: 

FHL  =  Component  and/or  area  hazard  units  x  100 
Total  System  hazard  units 

7.2. 1.3  Escape  Time  Discussion. 

The  length  of  time  required  for  evacuation  from  a  crashed  aircraft  can  differ  for  a  variety  of 

reasons.  Examples  include  ratio  of  occupants  to  usable  exits,  ease  of  exit  operation,  interference 


FCS  = 

LSCF  = 

FSOF  = 

EET  = 


0-20  seconds 
20  -  40  seconds 
40  -  60  seconds 
60  -  80  seconds 
80  -  100  seconds 
100  -  120  seconds 
120  -  140  seconds 
140  -  160  seconds 
160-  180  seconds 
180  - 
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problems  with  things  such  as  cargo,  fire,  etc.,  the  degree  of  occupant  injury,  and  the  availability 
of  rescue  personnel. 

Studies  by  the  authors  of  this  report  and  others  of  aircraft  crash  fire  growth  rates  and  of 
evacuation  times  used  by  survivors  in  over  4,500  air  crashes  have  shown  that  most  evacuations 
fall  into  one  of  two  categories.  Either  the  occupants  are  out  of  the  aircraft  within  a  few  seconds 
to  a  minute  or  two,  or  they  are  in  the  aircraft  for  a  much  longer  period  of  time— in  some  cases 
hours  or  days. 

The  growth  rates  of  typical  postcrash  fires  are  such  that  they  usually  start  out  small,  grow  in 
intensity  for  several  minutes,  then  start  to  subside.  Man’s  ability  to  survive  these  fires  is  usually 
predicated  on  the  clothing  he  is  wearing,  the  air  he  is  breathing,  the  temperature  to  which  he  is 
being  exposed,  and  the  duration  of  his  exposure. 

A  summary  of  actual  crash  data,  as  well  as  experimental  crash  test  data,  indicates  that  three 
minutes  is  about  as  long  as  one  can  expect  to  survive  in  a  major  crash  fire.  In  fact,  the  survival 
time  will  be  much  less  in  many  crashes,  due  primarily  to  the  close  proximity  of  the  fuel  to  the 
occupants. 

For  further  study  of  the  subject,  the  reader  is  referred  to  the  scientific  literature,  much  of  which  is 
summarized  in  volume  v  of  the  U.S.  Army  “Aircraft  Crash  Survival  Design  Guide,” 
USAAVSCOM  TR  89-D-22E  [86],  coauthored  by  the  authors  of  this  report.  It  is  the  basic 
handbook  in  the  field  and  is  available  from  the  U.S.  National  Technical  Information  Service. 

7.2.2  Example  Fuel  System  Fire  Hazard  Level  Evaluation. 

The  fuel  system  used  as  an  example  is  shown  in  figure  7-1. 

7.2.2. 1  Fuel  System  Fire  Hazard  Level — Original  System. 

The  original  fuel  system  hazard  level  is  shown  in  table  7-3.  The  fuel  system  items  were 
evaluated  in  accordance  with  the  procedures  described  under  section  7.2.1.  The  table  shows  that 
the  original  fuel  system  has  a  total  fire  hazard  level  of  100%,  and  that  the  100%  level  was 
derived  from  a  hazard  unit  level  of  73.4. 

Study  of  the  individual  fire  hazard  level  percentage  clearly  shows  that  item  3,  fuel  tank  outlet,  is 
the  principal  contributor  to  the  fire  problem.  Items  4,  6,  7,  and  9  are  also  major  contributors, 
while  Items  1,  2,  5,  and  8  are  much  less  hazardous. 

1222  Fuel  System  Fire  Hazard  Level — Modified  System. 

Once  the  evaluation  process  yields  the  fire  hazard  level  for  the  original  fuel  system,  design 
change  options  are  theorized  which,  if  implemented,  will  reduce  the  overall  fire  threat.  For 
example,  item  3  could  be  modified  to  greatly  reduce  fuel  spillage  during  a  crash  by  (1)  using 
crash-resistant  high-strength  fittings  in  the  tanks,  (2)  installing  self-sealing  breakaway  valves  at 
the  couplings  between  the  tanks  and  fuel  lines  and,  (3)  making  the  fuel  lines  from  flexible,  longer 
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hose  to  accommodate  relative  displacement  between  fuel  system  components.  The  rating  for 
item  3  might  be  as  shown  in  table  7-4,  resulting  in  a  fire  hazard  reduction  of  99.8  percent  for  this 
one  item  only.  However,  the  changes  made  would  also  reduce  the  fire  hazard  level  of  the  fuel 
lines  (item  4)  by  75.1  percent,  as  shown  in  table  7-4.  The  effect  of  these  changes  would  reduce 
the  fire  hazard  level  of  the  overall  fuel  system  by  3 1  percent. 


TABLE  7-4.  SAMPLE  HYPOTHETICAL  FUEL  SYSTEM  FIRE  HAZARD  LEVEL- 

MODIFIED 


Item 

Description 

Percent 

FCS1 

Percent 

LSCF2 

Points 

FSOF3 

Points 

EET4 

Hazard 

Units5 

Fire 

Hazard 

Level6 

Percent 

Hazard 

Reduction7 

i 

Filler  openings 

50 

50 

8 

8 

4.00 

5.45 

0 

2 

Tanks 

50 

80 

10 

10 

8.00 

10.90 

0 

3 

Outlets 

10 

10 

2 

1 

0.03 

0.04 

99.8 

4 

Fuel  lines  (tank-to-tank) 

20 

70 

8 

8 

2.24 

3.05 

75.1 

5 

Fuel  lines(tank-to- 
engine) 

80 

30 

8 

8 

3.84 

5.23 

0 

6 

Valves  (selector) 

80 

75 

10 

7 

10.20 

13.90 

0 

7 

Valves  (firewall  shutoff) 

75 

75 

10 

7 

9.56 

13.02 

0 

8 

Filters 

20 

75 

10 

6 

2.40 

3.27 

0 

9 

Pumps 

80 

75 

10 

7 

10.20 

13.90 

0 

Totals 

50.47 

68.76 

31.24 

Notes: 

1.  FCS  =  Likelihood  of  a  component  to  fail  and  cause 
spillage 

2.  LSCF  =  Likelihood  of  spillage  catching  fire 

3.  FSOF  -  Likelihood  of  fire  starting  other  fires 

4.  EET  =  Numeric  code  representing  estimated  escape  time 
for  occupants 

5.  Hazard  Units  =  (FCS/ 100  x  LSCF/ 100)  x  (FSOF  +  EET) 


6.  Fire  Hazard  Level  = 

Hazard  Units  (by  item)  x  100 
Hazard  Units  (total  unmodified) 

8.  Percent  Fire  Hazard  Reduction  = 

Basic  Hazard  Level  -  Modified  Hazard  Level  x  100 
Basic  Hazard  Level 
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8.  REGULATORY  ISSUES. 


8J  INTRODUCTION. 

Title  14  CFR  Part  25 — Airworthiness  Standards:  Transport  Category  Airplanes — originated  as 
the  recodification  of  CAR  Part  4b  following  establishment  of  the  Federal  Aviation 
Administration  by  the  Federal  Aviation  Act  of  1958  (72  Stat.  731).  In  the  40+  years  since  its 
inception,  14  CFR  Part  25  has  been  upgraded  continually  attempting  to  maintain  currency  with 
technological  progress.  Along  the  way  it  has  been  necessary  for  the  FAA  to  issue  Advisory 
Circulars  (AC)  to  supplement  the  CFRs,  principally  defining  acceptable  means  for  compliance 
with  the  regulatory  mandates.  As  the  plethora  of  certification  paperwork  needed  to  supplement 
the  actual  CFRs  grew,  it  became  evident  that  designers,  manufacturers,  modifiers,  operators,  and 
even  FAA  certification  officials  themselves  needed  simpler  access  to  certification  history. 

The  FAA  recently  began  a  process  by  which  historic  certification  documentation  would  be 
compiled  into  a  series  of  documents  according  to  category.  Popularly  titled  ‘Mega-ACs,  the 
program’s  initial  products  have  been  AC  29-2B  (now  -  2C)  for  Transport  Rotorcraft  certificated 
under  14  CFR  Part  29,  AC  27-1 A  for  Normal  Category  Rotorcraft  certificated  under  14  CFR  Part 
27,  and  two  of  a  proposed  set  of  five  ACs  for  Transport  Category  Airplanes  certificated  under  14 
CFR  Part  25  (see  section  8.3.4  below).  The  initial  round  of  Mega-ACs  experienced  some 
formatting  and  content  quality  inconsistencies  between  regional  certification  directorates. 
However,  the  ASW  Rotorcraft  Certification  Directorate’s  revision  of  AC  29-2B  to  29-2C  in  2 
years,  incorporating  major  changes  fed  back  from  its  constituency,  demonstrates  that  these 
documents  can  be  forged  into  much  more  user-friendly  reference  documents.  It  is  believed  that 
the  FAA’s  efforts  to  collect  all  available  certification  data  into  a  series  of  Mega-ACs  will  lead  to 
greater  productivity  and  less  ambiguity  than  exist  using  the  “old”  system. 

8.2  EXISTING  1 4  CFR  PART  25  COVERAGE. 

Amendment  25-91  [93]  most  recently  amended  §25.561  by  increasing  the  “ultimate  inertial 
forces”  specified  under  which  transport  airplane  structures  must  provide  protection  for  occupants 
in  a  “minor  crash  landing”  (not  otherwise  defined): 

8.2.1  Subpart  C-Structure— Emergency  Landing  Conditions. 

FAR  §25.561  General. 

(a)  The  airplane,  although  it  may  be  damaged  in  emergency  landing  conditions  on  land 
or  water,  must  be  designed  as  prescribed  in  this  section  to  protect  each  occupant 
under  those  conditions. 

(b)  The  structure  must  be  designed  to  give  each  occupant  every  reasonable  chance  of 
escaping  serious  injury  in  a  minor  crash  landing  when  - 

(1)  Proper  use  is  made  of  seats,  belts,  and  all  other  safety  design  provisions; 

(2)  The  wheels  are  retracted  (where  applicable);  and 
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(3)  The  occupant  experiences  the  following  ultimate  inertia  forces  acting 
separately  relative  to  the  surrounding  structure: 

(i)  Upward,  3.0  g 

(ii)  Forward,  9.0  g 

(iii)  Sideward,  3.0  g  on  the  airframe;  and  4.0  g  on  the  seats  and  their 
attachments. 

(iv)  Downward,  6.0  g 

(v)  Rearward,  1.5  g 

(c)  For  equipment,  cargo  in  the  passenger  compartments  and  any  other  large  masses, 
the  following  apply: 

(1)  Except  as  provided  in  paragraph  (c)(2)  of  this  section,  these  items  must  be 
positioned  so  that  if  they  break  loose  they  will  be  unlikely  to: 

(i)  Cause  direct  injury  to  occupants; 

(ii)  Penetrate  fuel  tanks  or  lines  or  cause  fire  or  explosion  hazard  by  damage 
to  adjacent  systems;  or 

(iii)  Nullify  any  of  the  escape  facilities  provided  for  use  after  an  emergency 
landing. 

(2)  When  such  positioning  is  not  practical  (e.g.,  fuselage  mounted  engines  or 
auxiliary  power  units)  each  such  item  of  mass  shall  be  restrained  under  all 
loads  up  to  those  specified  in  paragraph  (b)(3)  of  this  section.  The  local 
attachments  for  these  items  should  be  designed  to  withstand  1.33  times  the 
specified  loads  if  these  items  are  subject  to  severe  wear  and  tear  through 
frequent  removal  (e.g.,  quick  change  interior  items). 

(d)  Seats  and  items  of  mass  (and  their  supporting  structure)  must  not  deform  under  any 
loads  up  to  those  specified  in  paragraph  (b)(3)  of  this  section  in  any  manner  that 
would  impede  subsequent  rapid  evacuation  of  occupants. 

[Doc.  No.  5066,  29  FR  18291,  Dec.  24,  1964,  as  amended  by  Arndt.  25-23,  35  FR  5673,  Apr.  8, 
1970;  Arndt.  25-64,  53  FR  17646,  May  17,  1988;  Arndt.  25-91,  62  FR  40706,  July  29,  1997] 

8.2.2  Other  FAR  Part  25  Sections. 

Of  the  other  18  regulatory  sections  of  14  CFR  Part  25  which  apply  to  crashworthiness  design 
issues  affecting  postcrash  fires,  four  were  updated  in  1977,  two  in  1984,  and  one  each  in  1990, 
1989,  1978,  and  1972.  The  remaining  eight  are  more  than  30  years  old.  The  significance  of  the 
superannuity  of  those  design  criteria  lies  in  the  fact  that  1970  marked  the  transition  to  CRFSs  in 
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the  U.S.  Army’s  helicopter  fleet.  Their  introduction  minimized  unnecessary  carnage  generated 
by  postcrash  fires  which  resulted  from  spillage  after  fuel  system  damage  in  otherwise  survivable 
accidents.  Statistical  study  and  advisory  committee  recommendations  issued  subsequent  to  the 
U.S.  Army’s  rotorcraft  initiatives  have  borne  little  fruit.  (See  other  sections  of  this  report.)  The 
dearth  of  state-of-the-art  CRFS  design  criteria  in  14  CFR  Part  25  compares  poorly  to  the  FAA’s 
initiative  in  advancing  rotorcraft  CRFS  design  in  14  CFR  Part  27,  Normal  Category  Rotorcraft, 
and  Part  29,  Transport  Category  Rotorcraft. 

8.2.2. 1  Landing  Gear. 

§  25.721  General. 

(a)  The  main  landing  gear  system  must  be  designed  so  that  if  it  fails  due  to  overloads 
during  takeoff  and  landing  (assuming  the  overloads  to  act  in  the  upward  and  aft 
directions),  the  failure  mode  is  not  likely  to  cause  - 

(1)  For  airplanes  that  have  passenger  seating  configuration,  excluding  pilots  seats, 
of  nine  seats  or  less,  the  spillage  of  enough  fuel  from  any  fuel  system  in  the 
fuselage  to  constitute  a  fire  hazard;  and 

(2)  For  airplanes  that  have  a  passenger  seating  configuration,  excluding  pilots 
seats,  of  10  seats  or  more,  the  spillage  of  enough  fuel  from  any  part  of  the  fuel 
system  to  constitute  a  fire  hazard. 

(b)  Each  airplane  that  has  a  passenger  seating  configuration,  excluding  pilots  seats,  of 
10  seats  or  more  must  be  designed  so  that,  with  the  airplane  under  control,  it  can  be 
landed  on  a  paved  runway  with  any  one  or  more  landing  gear  legs  not  extended 
without  sustaining  a  structural  component  failure  that  is  likely  to  cause  the  spillage 
of  enough  fuel  to  constitute  a  fire  hazard. 

(c)  Compliance  with  the  provisions  of  this  section  may  be  shown  by  analysis  or  tests, 
or  both. 

[Arndt.  25-32,  37  FR  3969,  Feb.  24,  1972] 

8.2.2.2  Fuel  System. 

§  25.963  Fuel  tanks:  general. 

(a)  Each  fuel  tank  must  be  able  to  withstand,  without  failure,  the  vibration,  inertia, 
fluid,  and  structural  loads  that  it  may  be  subjected  to  in  operation. 

(b)  Flexible  fuel  tank  liners  must  be  approved  or  must  be  shown  to  be  suitable  for  the 
particular  application. 

(c)  Integral  fuel  tanks  must  have  facilities  for  interior  inspection  and  repair. 
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(d)  Fuel  tanks  within  the  fuselage  contour  must  be  able  to  resist  rupture  and  to  retain 
fuel,  under  the  inertia  forces  prescribed  for  the  emergency  landing  conditions  in  § 
25.561.  In  addition,  these  tanks  must  be  in  a  protected  position  so  that  exposure  of 
the  tanks  to  scraping  action  with  the  ground  is  unlikely. 

(e)  Fuel  tank  access  covers  must  comply  with  the  following  criteria  in  order  to  avoid 
loss  of  hazardous  quantities  of  fuel: 

(1)  All  covers  located  in  an  area  where  experience  or  analysis  indicates  a  strike  is 
likely  must  be  shown  by  analysis  or  tests  to  minimize  penetration  and 
deformation  by  tire  fragments,  low  energy  engine  debris,  or  other  likely 
debris. 

(2)  All  covers  must  be  fire  resistant  as  defined  in  part  1  of  this  section. 

(f)  For  pressurized  fuel  tanks,  a  means  with  fail-safe  features  must  be  provided  to 
prevent  the  buildup  of  an  excessive  pressure  difference  between  the  inside  and  the 
outside  of  the  tank. 

[Doc.  No.  5066,  29  FR  18291,  Dec.  24,  1964,  as  amended  by  Arndt.  25-40,  42  FR  15043  Mar 
17, 1977;  Arndt.  25-69,  54  FR  40352,  Sept.  29,  1989] 

§  25.965  Fuel  tank  tests. 

(a)  It  must  be  shown  by  tests  that  the  fuel  tanks,  as  mounted  in  the  airplane,  can 
withstand,  without  failure  or  leakage,  the  more  critical  of  the  pressures  resulting 
from  the  conditions  specified  in  paragraphs  (a)(1)  and  (2)  of  this  section.  In 
addition,  it  must  be  shown  by  either  analysis  or  tests,  that  tank  surfaces  subjected  to 
more  critical  pressures  resulting  from  the  condition  of  paragraphs  (a)(3)  and  (4)  of 
this  section,  are  able  to  withstand  the  following  pressures: 

(1)  An  internal  pressure  of  3.5  psi. 

(2)  125  percent  of  the  maximum  air  pressure  developed  in  the  tank  from  ram 
effect. 

(3)  Fluid  pressures  developed  during  maximum  limit  accelerations,  and 
deflections,  of  the  airplane  with  a  full  tank. 

(4)  Fluid  pressures  developed  during  the  most  adverse  combination  of  airplane 
roll  and  fuel  load. 

(b)  Each  metallic  tank  with  large  unsupported  or  unstiffened  flat  surfaces,  whose 
failure  or  deformation  could  cause  fuel  leakage,  must  be  able  to  withstand  the 
following  test,  or  its  equivalent,  without  leakage  or  excessive  deformation  of  the 
tank  walls: 
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(1)  Each  complete  tank  assembly  and  its  supports  must  be  vibration  tested  while 
mounted  to  simulate  the  actual  installation. 

(2)  Except  as  specified  in  paragraph  (b)(4)  of  this  section,  the  tank  assembly  must 
be  vibrated  for  25  hours  at  an  amplitude  of  not  less  than  1/32  of  an  inch 
(unless  another  amplitude  is  substantiated)  while  2/3  filled  with  water  or  other 
suitable  test  fluid. 

(3)  The  test  frequency  of  vibration  must  be  as  follows: 

(i)  If  no  frequency  of  vibration  resulting  from  any  rpm  within  the  normal 
operating  range  of  engine  speeds  is  critical,  the  test  frequency  of 
vibration  must  be  2,000  cycles  per  minute. 

(ii)  If  only  one  frequency  of  vibration  resulting  from  any  rpm  within  the 
normal  operating  range  of  engine  speeds  is  critical,  that  frequency  of 
vibration  must  be  the  test  frequency. 

(iii)  If  more  than  one  frequency  of  vibration  resulting  from  any  rpm  within 
the  normal  operating  range  of  engine  speeds  is  critical,  the  most  critical 
of  these  frequencies  must  be  the  test  frequency. 

(4)  Under  paragraphs  (b)(3)  (ii)  and  (iii)  of  this  section,  the  time  of  test  must  be 
adjusted  to  accomplish  the  same  number  of  vibration  cycles  that  would  be 
accomplished  in  25  hours  at  the  frequency  specified  in  paragraph  (b)(3)(i)  of 
this  section. 

(5)  During  the  test,  the  tank  assembly  must  be  rocked  at  the  rate  of  16  to  20 
complete  cycles  per  minute,  through  an  angle  of  15°  on  both  sides  of  the 
horizontal  (30°  total),  about  the  most  critical  axis,  for  25  hours.  If  motion 
about  more  than  one  axis  is  likely  to  be  critical,  the  tank  must  be  rocked  about 
each  critical  axis  for  12  1/2  hours. 

(c)  Except  where  satisfactory  operating  experience  with  a  similar  tank  in  a  similar 
installation  is  shown,  nonmetallic  tanks  must  withstand  the  test  specified  in 
paragraph  (b)(5)  of  this  section,  with  fuel  at  a  temperature  of  110°  F.  During  this 
test,  a  representative  specimen  of  the  tank  must  be  installed  in  a  supporting 
structure  simulating  the  installation  in  the  airplane. 

(d)  For  pressurized  fuel  tanks,  it  must  be  shown  by  analysis  or  tests  that  the  fuel  tanks 
can  withstand  the  maximum  pressure  likely  to  occur  on  the  ground  or  in  flight. 

[Doc.  No.  5066,  29  FR  18291,  Dec.  24,  1964,  as  amended  by  Arndt.  25-11,  32  FR  6913,  May  5, 
1967;  Arndt.  25-40,  42  FR  15043,  Mar.  17,  1977] 
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§  25.967  Fuel  tank  installations. 


(a)  Each  fuel  tank  must  be  supported  so  that  tank  loads  (resulting  from  the  weight  of 
the  fuel  in  the  tanks)  are  not  concentrated  on  unsupported  tank  surfaces.  In 
addition  - 

(1)  There  must  be  pads,  if  necessary,  to  prevent  chafing  between  the  tank  and  its 
supports; 

(2)  Padding  must  be  nonabsorbent  or  treated  to  prevent  the  absorption  of  fluids; 

(3)  If  a  flexible  tank  liner  is  used,  it  must  be  supported  so  that  it  is  not  required  to 
withstand  fluid  loads;  and 

(4)  Each  interior  surface  of  the  tank  compartment  must  be  smooth  and  free  of 
projections  that  could  cause  wear  of  the  liner  unless  - 

(i)  Provisions  are  made  for  protection  of  the  liner  at  these  points;  or 

(ii)  The  construction  of  the  liner  itself  provides  that  protection. 

(b)  Spaces  adjacent  to  tank  surfaces  must  be  ventilated  to  avoid  fume  accumulation  due 
to  minor  leakage.  If  the  tank  is  in  a  sealed  compartment,  ventilation  may  be  limited 
to  drain  holes  large  enough  to  prevent  excessive  pressure  resulting  from  altitude 
changes. 

(c)  The  location  of  each  tank  must  meet  the  requirements  of  §  25.11 85(a). 

(d)  No  engine  nacelle  skin  immediately  behind  a  major  air  outlet  from  the  engine 
compartment  may  act  as  the  wall  of  an  integral  tank. 

(e)  Each  fuel  tank  must  be  isolated  from  personnel  compartments  by  a  fumeproof  and 
fuelproof  enclosure. 

§  25.975  Fuel  tank  vents  and  carburetor  vapor  vents. 

(a)  Fuel  tank  vents.  Each  fuel  tank  must  be  vented  from  the  top  part  of  the  expansion 
space  so  that  venting  is  effective  under  any  normal  flight  condition.  In  addition  - 

(1)  Each  vent  must  be  arranged  to  avoid  stoppage  by  dirt  or  ice  formation; 

(2)  The  vent  arrangement  must  prevent  siphoning  of  fuel  during  normal 
operation; 

(3)  The  venting  capacity  and  vent  pressure  levels  must  maintain  acceptable 
differences  of  pressure  between  the  interior  and  exterior  of  the  tank,  during  - 

(i)  Normal  flight  operation; 
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(ii)  Maximum  rate  of  ascent  and  descent;  and 

(iii)  Refueling  and  defueling  (where  applicable); 

(4)  Airspaces  of  tanks  with  interconnected  outlets  must  be  interconnected; 

(5)  There  may  be  no  point  in  any  vent  line  where  moisture  can  accumulate  with 
the  airplane  in  the  ground  attitude  or  the  level  flight  attitude,  unless  drainage 
is  provided;  and 

(6)  No  vent  or  drainage  provision  may  end  at  any  point  - 

(i)  Where  the  discharge  of  fuel  from  the  vent  outlet  would  constitute  a  fire 
hazard;  or 

(ii)  From  which  fumes  could  enter  personnel  compartments. 

(b)  Carburetor  vapor  vents.  Each  carburetor  with  vapor  elimination  connections  must 
have  a  vent  line  to  lead  vapors  back  to  one  of  the  fuel  tanks.  In  addition  - 

(1)  Each  vent  system  must  have  means  to  avoid  stoppage  by  ice;  and 

(2)  If  there  is  more  than  one  fuel  tank,  and  it  is  necessary  to  use  the  tanks  in  a 
definite  sequence,  each  vapor  vent  return  line  must  lead  back  to  the  fuel  tank 
used  for  takeoff  and  landing. 

§  25.993  Fuel  system  lines  and  fittings. 

(a)  Each  fuel  line  must  be  installed  and  supported  to  prevent  excessive  vibration  and  to 
withstand  loads  due  to  fuel  pressure  and  accelerated  flight  conditions. 

(b)  Each  fuel  line  connected  to  components  of  the  airplane  between  which  relative 
motion  could  exist  must  have  provisions  for  flexibility. 

(c)  Each  flexible  connection  in  fuel  lines  that  may  be  under  pressure  and  subjected  to 
axial  loading  must  use  flexible  hose  assemblies. 

(d)  Flexible  hose  must  be  approved  or  must  be  shown  to  be  suitable  for  the  particular 
application. 

(e)  No  flexible  hose  that  might  be  adversely  affected  by  exposure  to  high  temperatures 
may  be  used  where  excessive  temperatures  will  exist  during  operation  or  after 
engine  shut  down. 

(f)  Each  fuel  line  within  the  fuselage  must  be  designed  and  installed  to  allow  a 
reasonable  degree  of  deformation  and  stretching  without  leakage. 

[Doc.  No.  5066,  29  FR  18291,  Dec.  24,  1964,  as  amended  by  Arndt.  25-15,  32  FR  13266,  Sept. 
20, 1967] 
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§  25.994  Fuel  system  components. 


Fuel  system  components  in  an  engine  nacelle  or  in  the  fuselage  must  be  protected 
from  damage  which  could  result  in  spillage  of  enough  fuel  to  constitute  a  fire 
hazard  as  a  result  of  a  wheels  up  landing  on  a  paved  runway. 

[Arndt.  25-57,  49  FR  6848,  Feb.  23,  1984] 

§  25.995  Fuel  valves. 

In  addition  to  the  requirements  of  §  25.1189  for  shutoff  means,  each  fuel  valve 
must  - 

(a)  [Reserved] 

(b)  Be  supported  so  that  no  loads  resulting  from  their  operation  or  from  accelerated 
flight  conditions  are  transmitted  to  the  lines  attached  to  the  valve. 

[Doc.  No.  5066,  29  FR  18291,  Dec.  24,  1964,  as  amended  by  Arndt.  25-40,  42  FR  15043  Mar 
17,1977] 

§  25.997  Fuel  strainer  or  filter. 

There  must  be  a  fuel  strainer  or  filter  between  the  fuel  tank  outlet  and  the  inlet  of 
either  the  fuel  metering  device  or  an  engine  driven  positive  displacement  pump, 
whichever  is  nearer  the  fuel  tank  outlet.  This  fuel  strainer  or  filter  must  - 

(c)  Be  mounted  so  that  its  weight  is  not  supported  by  the  connecting  lines  or  by  the 
inlet  or  outlet  connections  of  the  strainer  or  filter  itself,  unless  adequate  strength 
margins  under  all  loading  conditions  are  provided  in  the  lines  and  connections. 

[Arndt.  No.  25-36,  39  FR  35460,  Oct.  1,  1974,  as  amended  by  Arndt.  25-57,  49  FR  6848  Feb 
23, 1984] 

§  25.999  Fuel  System  Drains. 

(b)  Each  drain  required  by  paragraph  (a)  of  this  section  must  - 
(3)  Flave  a  drain  valve  - 

(ii)  That  is  either  located  or  protected  to  prevent  fuel  spillage  in  the  event  of 
a  landing  with  landing  gear  retracted. 

[Doc.  No.  5066,  29FR18291,  Dec.  24,  1964  as  amended  by  Arndt.  25-38,  41FR55467  Dec  20 
1976]  '  ’ 
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8.2.2.3  Oil  System. 


§  25.1013  Oil  tanks. 

Installation.  Each  oil  tank  installation  must  meet  the  requirements  of  §  25 .967 .... 

(c)  Filler  connection.  Each  recessed  oil  tank  filler  connection  that  can  retain  any 
appreciable  quantity  of  oil  must  have  a  drain  that  discharges  clear  of  each  part  of 
the  airplane.  In  addition,  each  oil  tank  filler  cap  must  provide  an  oiltight  seal. 

(d)  Vent.  Oil  tanks  must  be  vented  as  follows: 

Each  oil  tank  must  be  vented  from  the  top  part  of  the  expansion  space  so  that 
venting  is  effective  under  any  normal  flight  condition. 

(f)  Flexible  oil  tank  liners.  Each  flexible  oil  tank  liner  must  be  approved  or  must  be 
shown  to  be  suitable  for  the  particular  application. 

[Doc.  No.  5066,  29  FR  18291,  Dec.  24,  as  amended  by  Arndt.  25-19,  33  FR  15410,  Oct.  17, 
1968;  Arndt.  25-23,  35  FR  5677,  Apr.  8,  1970;  Arndt.  25-36,  39  FR  35460,  Oct.  1,  1974;  Arndt. 
25-57,  49  FR  6848,  Feb.  23,  1984;  Arndt.  25-72,  55  FR  29785,  July  20,  1990] 

§  25.1017  Oil  lines  and  fittings. 

(a)  Each  oil  line  must  meet  the  requirements  of  §  25.993  and  each  oil  line  and  fitting  in 
any  designated  fire  zone  must  meet  the  requirements  of  §25.1183. 

(b)  Breather  lines  must  be  arranged  so  that  - 

(1)  Condensed  water  vapor  that  might  freeze  and  obstruct  the  line  cannot 
accumulate  at  any  point; 

(2)  The  breather  discharge  does  not  constitute  a  fire  hazard  if  foaming  occurs  or 
causes  emitted  oil  to  strike  the  pilot's  windshield;  and 

(3)  The  breather  does  not  discharge  into  the  engine  air  induction  system. 

8.2.3  Subpart  F  -  Equipment- 

General 


§  25.1309  Equipment,  systems,  and  installations. 

(a)  The  equipment,  systems,  and  installations  whose  functioning  is  required  by  this 
subsection,  must  be  designed  to  ensure  that  they  perform  their  intended  functions 
under  any  foreseeable  operating  condition. 
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(b)  The  airplane  systems  and  associated  components,  considered  separately  and  in 
relation  to  other  systems,  must  be  designed  so  that  - 

(1)  The  occurrence  of  any  failure  condition  which  would  prevent  the  continued 
safe  flight  and  landing  of  the  airplane  is  extremely  improbable,  and 

(2)  The  occurrence  of  any  other  failure  conditions  which  would  reduce  the 
capability  of  the  airplane  or  the  ability  of  the  crew  to  cope  with  adverse 
operating  conditions  is  improbable.... 

(d)  Compliance  with  the  requirements  of  paragraph  (b)  of  this  section  must  be  shown 
by  analysis,  and  where  necessary,  by  appropriate  ground,  flight,  or  simulator  tests. 
The  analysis  must  consider  - 

(1)  Possible  modes  of  failure,  including  malfunctions  and  damage  from  external 
sources. 

(2)  The  probability  of  multiple  failures  and  undetected  failures. 

(3)  The  resulting  effects  on  the  airplane  and  occupants,  considering  the  stage  of 
flight  and  operating  conditions. ... 

[Arndt.  25-23,  35  FR  5679,  Apr.  8,  1970,  as  amended  by  Arndt.  25-38,  41  FR  55467  Dec  20 
1976;  Arndt.  25-41,  42  FR  36970,  July  18,  1977] 

§  25. 1453  Protection  of  oxygen  equipment  from  rupture. 

Oxygen  pressure  tanks,  and  lines  between  tanks  and  the  shutoff  means,  must  be  - 

(a)  Protected  from  unsafe  temperatures;  and 

(b)  Located  where  the  probability  and  hazards  of  rupture  in  a  crash  landing  are 
minimized. 

83  OTHER  FAA  AND  DEPARTMENT  OF  TRANSPORTATION  (DOT)  GUIDANCE 
MATERIAL 

8.3. 1  Advisory  Circular  25.994-1 :  Design  Considerations  to  Protect  Fuel  Systems  During  a 
Wheels  Up  Landing  T94]. 


AC  25.994-1  was  issued  in  July  1986  in  response  to  “...inquiries  [which]  made  it  obvious  that  a 
description  of  the  wheels  up  landing  condition  and  the  maximum  loads  to  be  used  for  the  fuel 
system  components  should  have  been  established.”  [Authors’  Note:  The  inquiries  were 
submitted  shortly  after  14  CFR  §25.994  was  incorporated  into  the  regulations  by  Amendment 
25-23  in  April  1970.  The  FAA  offers  no  explanation  for  the  16-year  delay.] 
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AC  25.994-1  presents  the  following  guidance: 

4.  Discussion 

Section  25.994  requires  that  the  fuel  system  components  in  an  engine  nacelle  or  in 
the  fuselage  be  protected  from  damage  which  could  result  in  the  spillage  of 
enough  fuel  to  constitute  a  fire  hazard.  Fuel  is  the  most  likely  cause  of  a  fire 
following  a  wheels  up  landing  if  the  fuel  system  components  in  the  engine 
nacelles  and  the  fuselage  are  damaged  to  the  extent  that  fuel  is  released. 
Therefore,  the  location  and  routing  of  fuel  system  components  in  the  engine 
nacelle  and  fuselage  should  be  evaluated  with  respect  to  the  runway  scraping 
action  that  may  be  encountered  and  the  resultant  structural  distortion  that  may 
occur.  The  components  which  cannot  be  located  to  protect  them  from  likely 
damage  in  a  wheels  up  landing  should  be  designed  to  minimize  fuel  spillage  and 
leakage  into  zones  of  possible  or  likely  ignition  sources.  The  probable  migration 
of  fuel  should  be  evaluated  and  those  zones  where  fuel  is  likely  to  enter  should 
not  have  potential  ignition  sources.  Equipment  in  such  areas  should  be  explosion 
proof,  hermetically  sealed,  or  otherwise  qualified  to  operate  in  a  flammable  fluid 
leakage  zone. 

Fuel  system  components  and  likely  ignition  sources  (electrical  arcing  and  high 
temperature  surfaces  (above  400°F))  that  should  be  investigated  include  fuel 
shutoff  valves,  couplings,  fittings,  lines,  electrical  wiring,  electric  power  cables, 
electric  motors,  electric  motor  driven  pumps,  hot  air  conditioning  ducts  and 
engine  bleed  air  ducts.  Many  of  these  components  are  installed  in,  or  routed 
through  areas  susceptible  to  damage  resulting  from  a  wheels  up  landing. 

For  the  purposes  of  this  AC,  a  wheels  up  landing  is  defined  as  a  landing  on  a 
paved  runway  under  a  controlled  emergency  landing  condition  as  described  in 
Sec.  25.561.  The  damage  that  may  be  sustained  in  a  full  gear  up  landing  or  other 
failed  configurations,  such  as  one  or  two  gears  extended  or  all  gears  collapsed, 
cannot  be  precisely  determined.  However,  a  reasonable  design  effort  to  protect 
fuel  system  components  for  the  all  wheels  up  landing  should  minimize  the  extent 
of  component  damage  for  the  other  gear  failure  configurations. 

5.  Acceptable  Means  of  Compliance 

The  airplane  fuel  system  should  be  designed  to  minimize  the  spilling  or  leaking  of 
fuel  from  damaged  components  during  and  following  a  wheels  up  landing.  The 
unpreventable  release  of  fuel,  such  as  from  severed  or  punctured  fuel  lines 
downstream  from  shutoff  valves,  should  be  diverted  or  excluded  to  the  maximum 
extent  practicable  from  spreading  to  likely  ignition  sources. 

Fuel  lines  and  fuel  system  components  should  be  located  and  routed  as  far  as 
practicable  from  likely  impact  areas  where  structural  deformation  may  cause 
crushing,  severing,  punctures  or  high  tensile  loads  in  the  lines. 
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Fuel  lines  should  be  constructed  to  protect  their  integrity  during  and  after  a 
wheels  up  landing.  Flexible  and  stretchable  hoses  should  be  used  and  the  fuel  line 
should  be  designed  to  allow  stretching  or  movement  with  the  deformed  structure 
up  to  an  amount  likely  to  be  required  to  prevent  failure  under  high  tensile  or  shear 
loading.  Flexible  hoses  should  also  be  designed  and  qualified  to  absorb  the 
energy  that  would  likely  be  imparted  to  the  component  or  fuel  line  from  direct 
impact  resulting  from  structural  failure. 

Fuel  lines  and  fuel  system  components  within  the  engine  nacelle  should  be 
arranged  and  protected  to  the  maximum  extent  possible  so  that  spilled  fuel  caused 
by  damage  to  lines  or  components  from  a  wheels  up  landing  is  not  likely  to 
contact  hot  engine  surfaces  (over  400°F).  Fuel  lines  and  components  should  be 
shrouded  and  drained  to  accomplish  this  protection. 

In  areas  of  the  engine  nacelles,  pylons,  and  airplane  fuselage  that  are  susceptible 
to  being  damaged  by  a  wheels  up  landing,  fuel  lines  and  electrical  wiring  should 
be  isolated,  separated  and  routed  to  the  maximum  extent  practicable,  to  minimize 
the  hazards  of  spilled  fuel  flowing  into  an  area  containing  a  potential  ignition 
source.  In  addition,  electrical  components  should  be  acceptable  for  operation  in 
flammable  leakage  zones  identified  in  accordance  with  Sec.  25.863. 

Shielding  and  drainage  may  be  used  wherever  it  is  considered  appropriate  to 
prevent  spilled  fuel  from  spreading  to  potential  ignition  sources  or  occupied  areas. 

Drip  fences  and  drainage  troughs  can  be  used  to  divert  flow  of  spilled  fuel  from 
potential  ignition  sources  such  as  hot  engine  cases,  electrical  accessories,  and 
component  compartments.  Nonconductive  material  should  be  used  to  shroud 
electrical  wiring  that  might  be  damaged  by  deforming  structure. 

Fuel  shutoff  valves  should  not  be  located  within  engine  nacelles,  pylon  areas  or 
adjacent  to  engine  air  intakes  and  exhausts  where  they  may  be  subjected  to 
damage  from  impact  and  scraping  action  during  a  wheels  up  landing.  Fuel  shutoff 
valve  mountings  should,  as  a  minimum,  be  designed  for  the  inertial  loads  listed  in 
Sec.  25.561  unless  the  location  and  estimated  loads  in  the  area  impose  a  greater 
strength  requirement  to  maintain  the  shutoff  valve  mounting  integrity. 

Installation  of  auxiliary  fuel  tanks  and  systems  in  the  fuselage  should  be  based  on 
the  guidance  and  information  in  AC  25-8,  Auxiliary  Fuel  System  Installations. 

It  is  instructive  to  compare  the  content  of  Advisory  Circular  25.994-1,  which  is  merely  advisory 
“guidance”  for  airworthiness  design  of  transport  category  airplanes,  with  the  content  of  14  CFR 
§§27.952  and  29.952,  which  are  identical  regulatory  requirements  for  airworthiness  design  of 
normal  and  transport  category  rotorcraft,  respectively;  e.g.,: 

Fuel  line  self-sealing  breakaway  couplings.  Self-sealing  breakaway  couplings 
must  be  installed  unless  hazardous  relative  motion  of  fuel  system  components  to 
each  other  or  to  local  rotorcraft  structure  is  demonstrated  to  be  extremely 
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improbable  or  unless  other  means  are  provided.  The  couplings  or  equivalent 
devices  must  be  installed  at  all  fuel  tank-to-fuel  line  connections,  tank-to-tank 
interconnects,  and  at  other  points  in  the  fuel  system  where  local  structural 
deformation  could  lead  to  the  release  of  fuel. 

Frangible  or  deformable  structural  attachments.  Unless  hazardous  relative  motion 
of  fuel  tanks  and  fuel  system  components  to  local  rotorcraft  structure  is 
demonstrated  to  be  extremely  improbable  in  an  otherwise  survivable  impact, 
frangible  or  locally  deformable  attachments  of  fuel  tanks  and  fuel  system 
components  to  local  rotorcraft  structure  must  be  used.  The  attachment  of  fuel 
tanks  and  fuel  system  components  to  local  rotorcraft  structure,  whether  frangible 
or  locally  deformable,  must  be  designed  such  that  its  separation  or  relative  local 
deformation  will  occur  without  rupture  or  local  tearout  of  the  fuel  tank  or  fuel 
system  components  that  will  cause  fuel  leakage.  [. Emphases  added  by  the  authors 
of  this  report ] 

8.3.2  Advisory  Circular  25.963-1 :  Fuel  Tank  Access  Covers  T951. 

AC  25.963-1  was  issued  in  July  1992  to  provide  guidance  for  complying  with  the  certification 
requirements  of  14  CFR  Part  25.963(e)  for  fuel  tank  access  covers  for  turbine-powered  transport 
category  airplanes.  14  CFR  Part  25.963(e)  was  incorporated  by  Amendment  25-69,  54  FR 
40352,  Sept.  29,  1989,  following  a  fatal  accident  at  Manchester,  UK,  in  which  debris  penetrated 
underwing  fuel  tank  access  covers  of  a  B-737  following  engine  failure,  causing  massive  fuel 
spillage  and  subsequent  fire.  (See  section  4) 

AC  25.963-1  provides  the  following  guidance: 

4.  Impact  Resistance 

All  fuel  tank  access  covers  must  be  designed  to  minimize  penetration  and 
deformation  by  tire  fragments,  low  energy  engine  debris,  or  other  likely  debris, 
unless  the  covers  are  located  in  an  area  where  service  experience  indicates  a  strike 
is  not  likely.  [AUTHORS’  NOTE:  Note  that  this  “not  likely”  evaluation 
criterion  is  inconsistent  with  criteria  set  forth  in  FAR  §25.1309  and  AC  23.1309- 
1C;  e.g.,  “probable,”  “improbable”  or  “extremely  improbable”.]  The  rule  does 
not  specify  rigid  standards  for  impact  resistance  because  of  the  wide  range  of 
likely  debris  which  could  impact  the  covers.  The  applicant  should,  however, 
choose  to  “minimize  penetration  and  deformation”  by  testing  covers  using  debris 
of  a  type,  size,  trajectory,  and  velocity  that  represent  conditions  anticipated  in 
actual  service  for  the  airplane  model  involved.  The  access  covers,  however,  need 
not  be  more  impact  resistant  than  the  contiguous  tank  structure. 

The  requirement  that  the  impact  resistance  of  the  tank  access  cover  be  equivalent  to  the  impact 
resistance  of  “the  contiguous  tank  structure”  is  illogical  unless  one  considers  merely  the 
condition  in  which  the  tanks  are  integral  to  the  structure.  For  example,  the  impact  resistance  of 
an  integral  tank  access  cover  should  logically  replicate  the  impact  resistance  of  the  skins  which 
form  the  tank  wall.  It  does  not  follow  that  an  access  cover  over  a  CRFS-qualified  bladder  tank 
should  demonstrate  impact  resistance  equal  to  that  of  the  bladder  tank. 
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8.3.3  Advisory  Circular  25-8:  Auxiliary  Fuel  System  Installations  T961. 

AC  25-8  was  issued  on  May  2,  1986.  It  provides  guidance  on  acceptable  means  of  compliance 
with  FAR  requirements  for  installation  of  auxiliary  fuel  systems  in  transport  category  airplanes. 
AC  25-8  defines  “Auxiliary  fuel  system”  as: 

...  a  system  installed  within  the  airplane  which  makes  additional  fuel  available 
for  increasing  the  flight  range  of  that  airplane.  The  term  ‘auxiliary’  means  that 
this  system  is  secondary  to  and  backed  by  the  airplane’s  essential  fuel  system, 
i.e.,  that  the  functions  of  the  essential  fuel  system  are  immediately  available  and 
operative  without  immediate  supervision  by  the  flight  crew  in  the  event  of  failure 
or  inadvertent  depletion  of  fuel  in  the  auxiliary  fuel  system  (reference 
§25. 955(b)(2)).  In  essence,  an  airplane  equipped  with  an  auxiliary  fuel  system  is 
capable  of  safe  flight  even  when  the  auxiliary  fuel  system  is  not  used,  i.e.,  where 
its  fuel  storage  capacity  is  not  required  for  short  range  flight.  (AC  25-8; 
Appendix  1) 

Despite  substantial  and  detailed  guidance  on  design,  construction,  installation,  and  use  of 
auxiliary  fuel  systems,  AC  25-8  is  strangely  silent  with  reference  to  known  (and  proved) 
standards  for  crash-resistant  fuel  system  design.  For  example,  Chapter  1  of  AC  25-8,  titled  “Fuel 
System  Installation  Integrity  and  Crashworthiness,”  contains  no  references  whatsoever  to  CRFS 
design,  evaluation,  and  testing  criteria  established  in  MIL-STD-1290A  [97],  TR-89-D22E, 
Aircraft  Crash  Survival  Design  Guide,  [86],  ADS-11  [91]  or  ADS-36  [98].  Although  these 
documents  are  admittedly  directed  specifically  toward  rotary-wing  aircraft  crashworthy  fuel 
systems,  the  principles  therein  are  universally  applicable.  In  particular,  the  Postcrash  Fire 
Potential  Rating  methodology  of  ADS-11  and  ADS-36’s  methods  for  testing  fuel  systems, 
subsystems,  and  components  could  easily  be  adapted  to  provide  more  robust  criteria  for 
evaluating  the  crash-resistant  design  of  auxiliary  fuel  systems  in  transport  category  airplanes. 

Detailed  CRFS  component  design  criteria  contained  in  MIL-T-27422B  [30]  on  the  subject  of 
crash-resistant  fuel  tanks,  and  other  standards  relating  to  valves  and  hoses  and  their  preferred 
installation  parameters,  could  potentially  be  as  effective  in  mitigating  some  postcrash  fires  in 
transport  category  airplanes  as  they  have  been  in  helicopters.  It  was  considered  significant  that 
the  SAE  G-9  Fuel  Tank  Bladder  Sub-Committee  has  reached  consensus  on  a  new  fuel  tank 
specification  (MIL-PRF-27422)  that  essentially  reiterates  the  technical  details  of  MIL-T-27422B. 

8.3.4  New  FAA  Advisory  Circulars  Pertaining  to  Transport  Airplane  Certification-  The  Meea- 
ACs. 


The  Mega- AC  concept  came  to  fruition  subsequent  to  the  demise  of  NPRM  89-11  (see  section 
8.4.4).  During  efforts  to  “normalize”  airworthiness  regulations  with  the  European  Community 
(EC),  FAA  management  became  aware  that  many  previously  accepted  means  for  regulatory 
compliance  had  never  been  memorialized  in  a  format  conveniently  accessible  by  entities  who 
need  to  use  the  information.  The  objective  of  the  Mega- AC  initiative  was  to  compile  all  known 
historic  information  on  regulatory  intent,  and  currently  accepted  certification  practices,  into 
single-source  documents  available  to  all  potential  users. 
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The  first  attempted  Mega-AC  on  the  market  was  AC  29-2B,  relating  to  transport  category 
rotorcraft,  which  was  released  on  July  30,  1997.  Subsequent  feedback  led  to  a  streamlined  and 
more  user-friendly  AC  29-2C  and  AC  27- IB  for  normal  category  rotorcraft. 

Five  transport  airplane  Mega-ACs  are  contemplated  by  the  FAA  ANM  Transport  Airplane 
Certification  Office.  (See  reference  99  paragraph  4.a.,  p.  II.)  Each  will  address  one  technical 
regulatory  area  pertaining  to  transport  airplanes: 

Certification  of  Transport  Airplane  Structure  (AC  25-21); 

Certification  of  Transport  Airplane  Mechanical  Systems  (AC  25-22); 

Certification  of  Electrical  Equipment  Installation  (Proposed  AC  25-XX); 

Transport  Airplane  Propulsion  Engine  and  Auxiliary  Power  Unit  Installation  Certification 
Handbook  (Proposed  AC  25-XX);  and 

Transport  Airplane  Cabin  Interiors  Handbook  (Proposed  AC  25-17A). 

According  to  the  FAA/AVR/AIR  web  site,  at  this  writing  (July  2000)  only  ACs  25-21  and  25-22 
have  been  issued.  Comment  period  closed  on  February  4,  2000,  for  AC  25-17A,  Transport 
Airplane  Cabin  Interiors  Handbook.  A  draft  of  Mega-AC  25-XX,  Transport  Airplane  Propulsion 
Engine  and  Auxiliary  Power  Unit  Installation  Certification  Handbook,  was  issued  for  which  the 
comment  period  closed  on  December  29,  1999.  At  some  1200  pages,  this  draft  Mega- AC  was 
criticized  for  being  unwieldy  and  cumbersome.  It  has  been  temporarily  withdrawn,  although  the 
full  text  is  available  on  the  FAA  web  site.  The  web  site  contains  no  current  status  for  AC  25- 
XX,  Certification  of  Electrical  Equipment  Installation. 

The  FAA  plans  an  additional  Mega-AC  33-XX  pertaining  to  aircraft  engines. 

8.3.4.1  Advisory  Circular  25-21:  Certification  of  Transport  Airplane  Structure  T 1 001  • 

AC  25-21,  dated  September  1, 1999,  has  as  its  purpose  to  provide: 

...methods  acceptable  to  the  Administrator  for  showing  compliance  with  the 
provisions  of  subparts  C  and  D  of  14  CFR  part  25  regarding  the  type  certification 
requirements  for  transport  airplane  structure.  This  AC  is  intended  to  provide 
guidance  to  airplane  manufacturers,  modifiers,  foreign  regulatory  authorities,  and 
Federal  Aviation  Administration  (FAA)  transport  airplane  type  certification 
engineers  and  their  designees.  The  methods  and  procedures  described  herein  have 
evolved  over  many  years  and  represent  current  certification  practice.  Like  all 
advisory  material,  these  guidelines  are  not  mandatory  and  do  not  constitute 
regulations.  They  are  derived  from  previous  FAA  experience  in  finding 
compliance  with  the  airworthiness  requirements  and  represent  methods  and 
procedures  found  to  be  acceptable  by  that  experience. 
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Among  AC  25-2 l’s  related  documents  specified  in  paragraph  3  therein,  are: 

•  Title  14  Code  of  Federal  Regulations  (14  CFR).  Sections  which  prescribe 
requirements  for  the  design,  substantiation,  and  certification  of  airplane  structure, 
landing  gear,  and  control  systems  include  all  sections  within  subpart  C,  Structure 
and  subpart  D,  Design  and  Construction,  except  for  the  crashworthiness  standards 
listed  in  Sections  810-819. 

•  Industry  Documents.  Military  specification  handbooks  relevant  to  flight 
vehicles. 

AC  25-21  also  incorporates  material  relating  to  other  Title  14  CFR  sections  outside  of  those 
subparts: 

•  Subpart  E  -  Powerplant:  §25.963  -  Fuel  Tanks:  General 

•  Subpart  G  -  Operating  Limitations  and  Information: 

-  §25.1517 -Rough  AirSpeed,  Vra 

§25. 1 529  and  Appendix  H  -  Instructions  for  Continued  Airworthiness 

AC  25-21  guidance  refers  only  to  three  of  the  14  CFR  Part  25  sections  previously  cited  as 
relevant  to  transport  airplane  design  factors  affecting  fuel  system  crashworthiness  and  postcrash 
fires: 


•  Subpart  C  -  Structure:  Emergency  Landing  Conditions— §25.561-  General 

•  Subpart  D  -  Design  and  Construction:  Landing  Gear — §25.721  -  General 

•  Subpart  E  -  Powerplant:  Fuel  Tanks — §25.963  -  General 

Unfortunately,  AC  25-21  offers  very  little  in  the  way  of  guidance  toward  an  acceptable  means  of 
compliance  for  any  of  these  sections.  For  example,  in  addition  to  the  text  of  the  FAR  sections 
cited,  AC  25-21  adds  the  following  “guidance”  material: 

•  For  FAR  §25.561: 

b.  Intent  of  Rule.  The  purpose  of  this  rule  is  to  ensure  that  occupants  will  have  a 
reasonable  chance  of  escaping  serious  injury  after  an  emergency  landing  on  either 
land  or  water. 

c.  Background.  This  rule  was  carried  forward  from  §  4b.260  of  the  Civil  Air 
Regulations  (CAR).  Amendment  25-23  made  minor  editorial  changes  for 
clarification.  Amendment  25-64  increased  the  inertia  load  factors  in  the  upward, 
sideward,  and  downward  directions  and  added  a  rearward  load  factor. 
Amendment  25-64  also  removed  the  reference  to  the  five  f.p.s.  ultimate  descent 
velocity.  Amendment  25-91  provided  a  factor  of  1.33  for  frequently  removed 
items. 
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d. 


Acceptable  Compliance  Methods.  For  guidance  on  compliance  with  this 
requirement,  refer  to  the  preamble  of  Amendment  25-23,  35  FR  5673,  April  8, 
1970;  Amendment  25-64,  53  FR  17646,  May  17,  1988;  and  Amendment  25-91, 
62  FR  40702,  July  29, 1997. 

•  References.  None. 

Attempts  to  locate  any  implementation  guidance  for  FAR  §25.561  in  Amendment  25-91  (the 
latest  applicable  regulatory  revision)  proved  futile.  The  Amendment  merely  alludes  in  passing  to 
the  revision’s  newly  imposed  structural  load  limits,  noting  the  purpose  of  the  change  was  to 
achieve  harmonization  with  European  regulators  via  the  Joint  Airworthiness  Requirements 
(JARs). 

•  For  FAR  §25.721: 

Intent  of  Rule.  The  purpose  of  this  rule  is  to  insure  that  if  the  landing  gear  fails  due  to 

overloads  during  takeoff  and  landing,  the  failure  itself  will  not  cause  the  spillage  of 

enough  fuel  from  any  part  of  the  fuel  system  to  constitute  a  fire  hazard. 

Background.  This  rule  was  added  by  Amendment  25-15  (Sept.  20,  1967).  Amendments 

25-23  2532  (sic)  extended  the  application  of  the  rule  to  include  all  fuel  systems. 

e.  Acceptable  Compliance  Methods.  For  guidance  on  compliance  with  this 
requirement,  refer  to  the  preamble  of  Amendment  25-15,  32  FR  13262, 
September  20,  1967;  Amendment  25-23,  35  FR  5676,  April  8,  1970;  and 
Amendment  25-32,  37  FR  3969,  February  24,  1972.  [AUTHORS’  NOTE:  None 
of  these  Amendments  are  readily  available  via  Internet,  or  any  other  easily 
accessible  source.  See  below.  ] 

f.  References.  None 

•  For  FAR  §25.963: 

b.  Intent  of  Rule.  The  purpose  of  this  rule  is  to  ensure  structural  integrity  of  the  fuel 
tanks  under  all  likely  operating  conditions,  including  emergency  landing 
conditions. 

c.  Background.  This  rule  was  carried  forward  from  §  4b. 420  of  the  Civil  Air 
Regulations  (CAR).  Amendment  25-40  removed  the  requirements  pertaining  to 
the  augmentation  liquid  tank  capacity.  Amendment  25-69  added  the  requirements 
pertaining  to  fuel  tank  access  covers. 

d.  Acceptable  Compliance  Methods.  Advisory  Circular  (AC)  25-963-1,  or  latest 
revision,  provides  guidance  information  for  showing  compliance  with  the  impact 
and  fire  resistance  requirements  of  25.963(e).  Fuel  tank  access  covers  must  be 
fire  resistant  and  meet  the  impact  criteria  specified  in  Advisory  Circular  25.963-1, 
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or  latest  revision.  Compliance  with  this  requirement  may  be  shown  by  test(s) 
and/or  analysis. 


References.  Advisory  Circular  25.963-1,  or  latest  revision,  Fuel  Tank  Access  Covers, 
and  AC  25-XX,  Transport  Airplane  Propulsion,  Engine,  and  APU  Certification 
Handbook. 


Searches  for  text  of  early  CFR  Amendments  or  issues  of  the  Federal  Register  at  easily  accessible 
locations  proved  fruitless.  The  U.S.  Government  Printing  Office  Internet  site  contains  references 
from  1994  forward  only.  Summit  Aviation’s  Computerized  Aviation  Reference  Library  CD 
contains  references  from  1990  forward  only.  According  to  the  GPO  Access  Support  Team, 
official  federal  regulatory  documents  issued  prior  to  1994  “...may  be  available  at  a  Federal 
Depository  Library.”  (emphasis  added  by  the  authors  of  this  report)  Historical  FAA/GPO  paper- 
copy  subscription  services  remain  available  as  a  source  for  complete  revision  histories  of 
selected  Parts  of  the  FARs.  These  documents  should  be  made  available  publicly  via  the  Internet. 

83.4.2  Advisory  Circular  25-22:  Certification  of  Transport  Airplane  Mechanical  Systems  1991. 

The  stated  purpose  of  AC  25-22,  dated  March  14,  2000,  is  to  provide  “. ..  methods  acceptable  to 
the  Administrator  for  showing  compliance  with  the  type  certification  requirements  for  transport 
airplane  mechanical  systems  and  equipment  installations.”  AC  25-22  opens  at  14  CFR  25.671  in 
the  control  systems  subdivision  of  Subpart  D — Design  and  Construction,  of  14  CFR  Part  25  and 
encompasses  46  CFR  sections  through  §25.1529:  “Instructions  for  Continuing  Airworthiness.” 

Of  title  14  CFR  sections  previously  cited  as  relating  to  CRFS,  only  §§25.1309,  25.1450,  and 
25.1453  are  cited  in  AC  25-22. 

Comments  at  48. d.  (pp.  128-130)  relating  to  14  CFR  25.1309  appear  to  raise  more  questions  than 
they  answer  about  the  acceptability  of  competing  methodologies  for  demonstrating  compliance 
with  certification  criteria  (e.g.,  qualitative  vs.  quantitative): 

Policy/Compliance  Methods.  The  term  “subsection”  in  §25. 1309(a)  is  intended  to 
cover  not  only  subsection  “C”,  but  also  the  equipment,  systems,  and  installations  not 
specifically  required  by  subsection  “C”  but  installed  in  airplanes  in  order  to  engage 
in  operations  covered  by  other  subsections.  Dependence  for  safety  of  flight  might  be 
placed  on  installations  not  otherwise  mentioned  in  the  rules. 

Probability  of  a  Fire.  The  following  is  extracted  from  an  FAA  memorandum,  dated 
March  9,  1995.  This  is  in  response  to  a  request  for  guidance  regarding  the  use  of  the 
probability  of  a  fire  in  a  failure  analysis  when  showing  compliance  with  §25.1309. 

The  focus  of  the  request  was  directed  at  the  three  issues  addressed  below: 

The  first  issue  concerns  whether  the  occurrence  of  a  cargo  compartment  fire  should 
be  considered  to  have  a  probability  of  one,  or  something  less  than  one.  Advisory 
Circular  (AC)  25.1309-1A,  paragraph  8e,  “Operational  and  Environmental 
Conditions”,  allows  that  random  conditions  may  be  considered  to  have  a  probability 
of  occurrence  less  than  one,  and  may  usually  be  included  in  a  safety  analysis.  The 
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AC  indicates  that  a  random  condition  is  a  condition  for  which  the  airplane  is  not 
designed,  and  in  which  the  airplane  is  not  normally  approved  to  operate.  It  also 
indicates  that  a  random  condition  may  be  used  in  the  analysis  even  when  the  system 
under  analysis  is  designed  to  protect  against  the  occurrence  of  the  random  condition. 
The  AC  provides,  as  an  example,  that  it  would  be  reasonable  and  rational  to  use  a 
probability  of  less  than  one  of  encountering  hazardous  turbulence  or  gust  levels  after 
the  failure  of  a  structural  load  alleviation  system.  A  probability  less  than  one  of  fire 
occurring  after  a  failure  of  the  fire  protection  system  is  similar  to  this  example,  and 
may  be  used  in  the  analysis.  Advisory  Circular  25. 13 09-1 A  also  provides  counter¬ 
examples  for  conditions  which  should  not  be  considered  random,  and  for  which  a 
probability  of  one  should  be  used.  These  are  conditions  for  which  the  airplane  is 
designed.  The  examples  provided,  instrument  meteorological  conditions  and 
Category  III  weather  operations,  are  conditions  in  which  the  airplane  would  be 
expected  to  operate  as  a  matter  of  course,  and  for  which  operational  approval  would 
be  granted. 

The  second  issue  concerns  what  value  less  than  one  should  be  assigned  to  the 
probability  of  occurrence  of  a  fire.  Advisory  Circular  25.1309-1A,  paragraph  8e, 
provides  guidance  that  the  statistically-derived  probability  used  in  the  analysis 
should  be  based  on  an  applicable  supporting  database  and  a  valid  statistical 
distribution.  When  requesting  approval  for  the  use  of  the  probability  of  a  random 
condition  in  a  safety  analysis,  it  is  incumbent  on  the  applicant  to  supply  the  data, 
show  the  applicability  of  the  database  from  which  the  data  is  supplied,  and  derive  a 
valid  statistical  conclusion.  The  ACO  (Aircraft  Certification  Office)  should  then 
evaluate  the  applicant’s  statistical  information  and  determine  if  the  value  used  in  the 
analysis  is  supported  by  the  data  presented.  This  value  must  be  reassessed  for 
subsequent  programs,  as  service  experience  gained  in  the  future  may  require  the 
probability  of  the  occurrence  to  be  re-evaluated. 

The  third  issue  is  whether  the  required  safety  level  reached  through  the  use  of  the 
Maintenance  Steering  Group,  Revision  3  (MSG-3)  procedures  is  higher  than  that 
reached  using  a  §25.1309  analysis.  We  contend  that  this  is  not  so,  and  that  a  like- 
comparison  of  the  two  sets  of  procedures  is  not  valid.  The  §25.1309  analysis  process 
is  directed  at  assessing  the  contributions  of  failures  to  given  failure  conditions,  and  to 
directing  the  airplane  or  system  design  appropriately.  The  MSG-3  process  is 
directed  at  determining  appropriate  maintenance  actions  given  the  contribution  of  a 
failure  to  a  reduction  in  safety.  Findings  from  the  §25.1309  analysis  process  are 
used  as  starting  points  for  certain  MSG-3  processes  to  determine  maintenance 
activities  and  intervals,  or  whether  the  maintenance  process  can  adequately  minimize 
the  risk  elements  assigned  to  it.  The  MSG-3  procedures  must  assume  the 
combination  of  a  system  failure  with  the  occurrence  of  the  condition,  which  the 
system  was  designed  to  protect  against,  in  order  to  account  for  hidden  failures  when 
determining  maintenance  actions.  Expected  or  allowable  probabilities  related  to 
system  failures  are  not  derived  through  the  MSG-3  process.  In  applying  the  above 
guidance,  note  that  §25.1309  is  a  rule  of  general  applicability,  and  should  not  be  used 
to  replace  a  more  specific  and  stringent  requirement.  Cargo  compartments,  and 
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compartment  fire  detection  and  protection  systems  must  meet  requirements  specified 
in  §§25.855,  25.857,  and  25.858,  regardless  of  probabilities  as  determined  in  a 
§25.1309  related  analysis. 

Examples.  For  an  example  of  compliance  with  §25. 1309(c),  see  paragraph  d(l) 
under  §25.1441,  Oxygen  equipment  and  supply,  of  this  AC.  Another  example  of 
compliance  is  included  under  paragraph  d(2),  §25.855,  Cargo  or  baggage 
compartments,  of  this  AC. 

Safe  and  Reliable.  The  following  is  extracted  from  an  FAA  memorandum  dated 
October  26,  1990,  and  addresses  an  inquiry  regarding  (i)  the  meaning  of  “Safe  and 
reliable”  used  in  §§25. 109(b)  and  25.125(b)(3)  in  terms  of  AC  25. 1309-1 A 
probability,  and  (ii)  the  acceptable  failure  probability  for  deceleration  devices  like 
anti-skid  and  ground  spoilers  that  have  relatively  large  and  small  effects  on  landing 
distance.  The  FAA  response  follows: 

Safe  and  reliable  is  generally  used  to  mean  that  a  failure  condition  is  improbable.  In 
terms  of  AC  25. 1309-1 A  quantitative  probability  terms,  improbable  failure 
conditions  are  those  having  a  probability  on  the  order  of  1  X  10'5  or  less. 

Each  deceleration  device,  such  as  anti-skid  and  ground  spoilers,  would  be  expected 
to  have  a  failure  condition  that  is  at  least  improbable  (i.e.  1  X  10'5  or  less)  regardless 
of  its  effect  on  stopping  distance. 

8.3.4.3  Advisory  Circular  25-17A:  Transport  Airplane  Cabin  Interiors  Crashworthiness 
Handbook  f  1011. 

The  comment  period  for  proposed  AC  25-17A  closed  on  February  4,  2000. 

Its  predecessor,  AC  25-17  [102],  issued  July  15,  1991,  specified  the  following  distinction: 

Airworthiness  design  objectives  pertain  to  the  ability  of  the  airframe  to  withstand 
design  loads,  or  to  maintain  safety  of  flight  of  the  airplane  relative  to  its 
operational  environment.  Crashworthiness  design  objectives  pertain  to  safety  of 
the  occupants  relative  to  the  airplane.  Some  aspects  of  crashworthiness,  for 
example,  fuel  tank/system  design,  fuselage  deformation  and  prevention  of 
postcrash  fires,  are  beyond  the  scope  of  this  AC.  (emphasis  added  by  the  authors 
of  this  report) 

The  FAA  ANM  Project  Manager  for  AC  25-1 7A  advised  that  he  anticipates  no  change  to  that 
applicability. 

AC  25-17  contains  a  definition  for  survivable  crash  which  seemingly  oversimplifies  factors 
involved  in  accidents  involving  transport  airplanes: 

A  survivable  crash  environment  prevails  when  the  cabin  occupants  are  subjected 
to  crash  forces  within  human  tolerance  levels,  and  the  structural  integrity  of  the 
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passenger  space  remains  intact  such  that  the  occupants  can  rapidly  evacuate  the 
airplane. 

Although  suitable  for  rotorcraft  and  small  airplanes  in  which  crash  forces  are  distributed 
relatively  evenly  across  the  airframe,  the  definition  fails  to  account  for  the  widely  variant  force 
distribution  across  the  fuselage  of  a  large  transport  airplane.  It  is  not  unlikely  that  all  occupants 
of  one  section  of  a  crashed  transport  airplane  perish,  while  almost  all  passengers  in  a  different 
section  survive.  The  Survivability  Chain  mathematical  model  developed  by  RGW  Cherry  & 
Associates  Ltd  enables  scientific  evaluation  of  differing  degrees  of  survivability  in  the  same 
accident.  [60] 

8.3.4.4  FAA-Proposed  Advisory  Circular  (AC)  25-XX  Transport  Airplane  Propulsion  Engine 
and  Auxiliary  Power  Unit  Installation  Certification  Handbook:  The  Propulsion  Mega- AC  f  1031. 

The  September  1999  draft  of  Proposed  AC  25-XX,  “The  Propulsion  Mega- AC”  states,  as  its 
purpose,  to  provide: 

...methods  acceptable  to  the  Administrator  for  showing  compliance  with  the  type 
certification  requirements  for  transport  airplane  propulsion  engine  and  auxiliary 
power  unit  (APU)  installations. 

...to  airplane  manufacturers,  modifiers,  foreign  regulatory  authorities,  and...(FAA) 
airplane  type  certification  engineers. 

The  methods  and  procedures  described  therein  have  evolved  through  many  years  and 
represent  current  certification  practice. 

AC  25-XX  incorporates  the  substance  of  the  following  Advisory  Circulars  relevant  to  the  subject 
of  this  report,  which  would  be  cancelled  by  its  issuance: 

AC  25-8:  Auxiliary  Fuel  System  Installation  (May  5, 1986) 

AC  25.963-1 :  Fuel  Tank  Access  Covers  (July  29,  1992) 

AC  25.994-1:  Design  Considerations  to  Protect  Fuel  Systems  during  a  Wheels- 

Up  Landing  (July  24,  1986) 


Sections  of  AC  25-XX  which  contain  guidance  relevant  to  this  report  are: 


Subpart  E, 


Section  2:  Fuel  System 

Section  3:  Fuel  System  Components 

Section  4:  Oil  System 

Section  9:  Powerplant  Fire  Protection 


Subpart  F,  Section  25.1309  Equipment,  systems  and  installation 
Appendix  3  Fuel  System  Certification  Checklist 
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Subpart  E,  Section  2,  encompasses  the  following  relevant  subsections,  keyed  to  corresponding 
sections  of  Part  25  of  14  CFR: 


§25.952 

Fuel  system  analysis  and  test 

§25.963 

Fuel  tanks,  general 

§25.965 

Fuel  tank  tests 

§25.967 

Fuel  tank  installations 

§25.973 

Fuel  tank  filler  connection 

§25.975 

Fuel  tank  vents  and  carburetor  vapor  vents 

Subpart  E,  Section  3,  encompasses  the  following  relevant  subsections,  keyed  to  corresponding 
sections  of  Part  25  of  14  CFR: 

§25.993  Fuel  system  lines  and  fittings 

§25.994  Fuel  system  components 

§25.995  Fuel  valves 

§25.997  Fuel  strainer  or  filter 

§25.999  Fuel  system  drains 

Subpart  E,  Section  4,  encompasses  the  following  relevant  subsections,  keyed  to  corresponding 
sections  of  Part  25  of  14  CFR: 

§25.1015  Oil  tank  tests 

§25.1017  Oil  lines  and  fittings 

§25.1025  Oil  valves 

Subpart  E,  Section  9,  includes  the  following  relevant  subsection,  corresponding  to  a  section  of 
Part  25  of  14  CFR: 

§25.1189  Shutoff  means 

Subpart  F,  Section  1,  includes  the  following  relevant  subsection,  corresponding  to  a  section  of 
Part  25  of  14  CFR: 

§25.1309  Equipment,  systems,  and  installations 

Appendix  3:  Fuel  System  Certification  Checklist,  was  developed  by  the  FAA’s  Small  Airplane 
Directorate  (ACE)  to  be  used  “...for  safety  meetings.  Type  Certificate  (TC),  Amended  TC,  and 
Supplemental  Type  Certificate  (STC)  compliance  inspections;  and  initial  or  special  type  board 
meetings.  It  is  a  qualitative  checklist  and  includes  the  following  evaluation  points  relevant  to 
this  report: 

§b.  Vent  Systems 

(11)  When  vent  lines  connect  engine  components  (carburetors,  fuel  injectors,  etc.) 
to  a  fuel  tank  expansion  space,  a  fractured  vent  will  not  pour  fuel  into  the 
engine  compartment  fire  zone  on  a  crash  landing  or  rollover. 
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§d.  Hardware  and  Components 

(9)  Are  flexible  hoses  used  to  account  for  expected  differential  motion  or 
deflections...? 

§f.  Crashworthiness 

(1)  Is  a  crashworthiness  evaluation  report  of  fuel  system  planned  which  shows 
that  precautions  have  been  taken  to  minimize  hazards  due  to  a  survivable 
crash  environment? 

(2)  If  aircraft  upsets  in  pitch  or  rollover,  is  fuel  system  designed  to  prevent  fuel 
spills  from  vents  or  lines  which  could  cause  a  fire  hazard? 

(3)  Is  system  crashworthy  with  adequate  slack  in  lines  to  permit  large  engine 
shifts  in  survivable  accidents  (to  16  Gs)  without  severing  lines  or 
connections? 

(4)  Are  self-sealing  valves  or  frangible  fittings  used  where  breakaways  near 
ignition  sources  are  likely  in  survivable  crash? 

(5)  In  the  event  of  a  wheels-up  landing,  can  fuel  tanks,  shutoff  valve  [s],  drain 
valves,  etc.,  fracture,  and  are  adjacent  ignition  sources,  such  as  electrical 
components  explosion  proof  or  hermetically  sealed?  Are  flexible  and 
stretchable  hoses  used?  (AC  25.994-XX) 

(6)  Are  fuel  system  components  and  engine  mounts  strong  enough  to  be 
nonhazardous  in  a  survivable  crash  (of  8-16  Gs)  even  though  the  current  rules 
call  for  3-4.5  Gs  download? 

(9)  Are  fuel  tanks  located  behind  spars  or  structure  to  provide  for  crash  and 
ignition  protection? 

§i.  Fuel  Tanks 

(7)  Bladders  will  not  normally  collapse  or  tear  due  to  rapid  altitude  changes,  hard 
landing,  blocked  vents,  etc.,  nor  deflect  from  inadequate  support  or  negative 
pressures  that  can  lead  to  erroneous  fuel  quantity  sensing  or  loss  or  fuel. 

(8)  Are  bladders  and  their  supports  structurally  applicable  to  prevent  collapse  or 
fracture?  TSO  or  better? 

The  ANM  Transport  Airplane  Directorate  plans  to  develop  a  similar  checklist  tailored  to  the 
requirements  of  Part  25  airplanes. 

The  authors  of  Proposed  AC  25-XX  commendably  make  frequent  reference  to  rotorcraft  ACs 
27- IB  and  29-2B  (AC  29-2C  was  issued  subsequent  to  the  issuance  of  Proposed  AC  25-XX) 
where  the  content  of  those  documents  is  relevant.  These  cross-cultural  referrals  can  be  valuable 
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for  exposing  alternative  means  of  compliance  on  issues  which  are  applicable  to  more  than  one 
vehicle  species.  The  draft  AC  has  been  temporarily  withheld  to  allow  additional  time  for 
industry  comment.  It  is  available  publicly  at  http://www.faa.gov/avr/air/  for  download  and 
comment.  Click  on  “draft  advisory  circulars”  on  pulldown  menu. 

PRIOR  GOVERNMENT  INITIATIVES  TOWARD  IMPROVING  CRFS  AND  MITIGATING 
POSTCRASH  FIRES  IN  PART  25  AIRPLANES. 

8.4:1  U  S.  Department  of  Transportation  Report  to  Congress:  Systems  and  Techniques  for 
Reducing  the  Incidence  of  Postcrash  Fuel  System  Fires  and  Explosions  [52], 

The  Department  of  Transportation’s  Report  to  Congress:  Systems  and  Techniques  for  Reducing 
the  Incidence  of  Post-Crash  Fuel  System  Fires  and  Explosions  (December  1988)  was  delivered 
to  the  Congress  in  January  1989.  It  responded  to  requirements  established  by  the  Airport  and 
Airway  Safety  and  Capacity  Expansion  Act  of  1987  (PL  100-223).  The  Act  required  the  DOT  to 
conduct  a  study  of  aircraft  design  and  equipment  which  minimized  the  incidence  of  postcrash 
fuel  system  fires  or  explosions. 

The  FAA  study  which  preceded  the  DOT  report  considered  11  methods  for  reducing  the 
postcrash  fire  and  explosion  hazard  in  transport  category  airplanes: 

Crash-resistant  fuel  tanks  and  breakaway,  self-closing  fittings 

Engine  ignition  suppression  systems 

Fuel  tank  nitrogen  inerting  systems 

Fuel  tank  foam  filler  explosion  suppression  systems 

Fuel  tank  chemical  agent  explosion  suppression  system 

Anti-misting  kerosene  (AMK) 

Fuel  tank  vent  flame  arrestor 

Surge  tank  chemical  agent  explosion  suppression  system 
Design  to  assure  fuel  tank-to-engine  shutoff  valve  activation 
Fire-resistant  fuel  tank  access  panels 
Revised  location  of  fuel  tanks  and  engines 

All  but  the  last  alternative  were  under  active  consideration  at  the  time,  and  various  alternatives 
had  been  studied  from  time  to  time  since  1964.  Early  initiatives  had  given  priority  to  in-flight 
explosion  prevention  over  postcrash  fires  and  their  effect  on  survivability.  (There  is  legitimate 
question  whether  that  priority  was  based  on  experiential  data.) 

The  FAA  issued  NPRM  74-16  in  1974  to  require  explosion  prevention  systems  in  transport 
airplanes.  Industry  responses  were  quick  to  point  out  that  explosion  prevention  systems  would 
be  ineffective  in  reducing  postcrash  fire  hazards  in  otherwise  impact-survivable  accidents, 
conditions  which  posed  significantly  greater  risk  to  occupants  than  in-flight  tank  explosions/ 
Following  public  hearings  in  1977,  NPRM  74-16  was  withdrawn  and  the  FAA  established  the 
Special  Aviation  Fire  and  Explosion  Reduction  (SAFER)  Committee  to  investigate  methods  for 
improving  post-crash  survivability. 


*  Risk  =  (Probability  of  Occurrence)  X  (Severity  of  the  Specified  Hazard). 
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8.4.2  Advanced  Notice  of  Proposed  Rulemaking  (ANPRM)  84-17. 


The  SAFER  Committee  proposed  the  following  regulatory  changes,  in  order  of  priority: 

Amend  FAR  Part  25  to  require  fuel  tank  vent  protection  during  ground  fires. 

(Subsequently  withdrawn) 

Amend  FAR  Part  25  to  require  design  practices  which  maximize  the 

probability  of  engine  fuel  supply  shut  off  in  potential  fire  situations.  (Limited 

to  redundant  manual  shut  off  methods) 

ANPRM  84-17  was  issued  in  the  U.S.  Federal  Register  on  September  26,  1984  (49  FR  38078). 
Its  purpose  was  to  obtain  public  comments,  information,  and  data  relating  to  adding  new 
airworthiness  standards  for  transport  category  airplane  fuel  systems  that  would  provide 
protection  against  fuel  tank  explosions  following  postcrash  ground  fires  and  assure  engine  and 
APU  fuel  supplies  would  be  shut  off  to  reduce  fire  hazards  from  spilled  fuel. 

8.4.3  Aviation  Safety  Research  Act  of  1988  (PL  100-591). 

The  Aviation  Safety  and  Research  Act  of  1988  [104]  was  enacted  during  the  rulemaking  period 
for  NPRM  84-17.  It  required  the  FAA  Administrator  to  issue  an  ANPRM  to  determine  the 
feasibility  of  installing  crashworthy  fuselage  fuel  tanks  and  fuselage  fuel  lines  in  air  carrier 
airplanes.  The  FAA  subsequently  published  ANPRM  89-1 1  to  fulfill  that  requirement. 

8.4.4  Advanced  Notice  of  Proposed  Rulemaking  (ANPRM)  89-11. 

ANPRM  89-1 1  was  issued  on  May  2,  1989  [105].  It  was  an  outgrowth  of  prior  FAA  attempts  to 
explore  methods  for  mitigating  postcrash  fires  which  had  theretofore  met  with  little  acceptance. 
Responses  to  ANPRM  89-11  led  the  FAA’s  Northwest-Mountain  Region  Transport  Airplane 
Directorate  to  draft  NPRM  89-1 1 A  proposing  the  following  amendments  to  14  CFR  Part  25: 

§25.963  Fuel  tanks:  General  [Revise  paragraph  (d)  to  read]: 

(d)  Fuel  tanks  within  the  fuselage  contour  must  be  able  to  resist  leakage  and  to  retain 
fuel,  under  the  inertia  forces  prescribed  for  the  emergency  landing  conditions  of 
§25.561.  In  addition,  these  tanks  must  be  located  in  a  protected  position  so  that 
exposure  to  penetration  or  damage  due  to  fuselage  deformation,  fuselage 
separation,  displaced  structural  members  (including  the  landing  gear),  and 
scraping  action  with  the  ground  is  unlikely. 

§25.993  Fuel  system  lines  and  fittings  [Revise  paragraph  (f)  and  add  new  paragraph  (g)] 

(f)  Each  fuel  line  routed  outside  the  fuel  tank  walls,  and  within  or  adjacent  to  the 
fuselage,  must  be  designed  and  installed  to  resist  leakage  when  the  line  is 
stretched  and  deformed  by  adjacent  structure  during  fuselage  separation.  This 
capability  must  be  shown  with  the  fuel  line  at  the  environmental  and  operating 
conditions  determined  to  be  critical. 
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(§)  Each  fuel  line  that  is  routed  outside  the  fuel  tank  walls  must  provide  a  means  to 
either: 

(1)  shut  off  the  supply  of  fuel  during  takeoff  and  landing,  or 

(2)  have  an  automatic  means  to  shut  off  the  fuel  supply  during  fuselage  or 
engine  separation. 

§25.1189  Shutoff  means.  [Add  new  paragraph  (i)] 

(i)  The  airframe-mounted  engine  and  auxiliary  power  unit  (APU)  fuel  shutoff 
valves  must  isolate  the  airplane  fuel  supply  from  the  engine  and  APU  during 
both  the  normal  and  emergency  shutdown  sequence. 

NPRM  89-1 1  ’s  issuance  was  overtaken  by  higher  priorities  within  the  FAA.  The  NPRM  was 
relegated  to  inactive  status  in  November  1995.  The  draft  NPRM  89-1 1 A  incorporated  many  of 
the  comments  and  suggestions  submitted  by  the  24  ANPRM  89-1 1  commenters  and  is  included 
m  this  report  as  appendix  B.  Unfortunately,  its  existence  was  only  learned  about  during  the  final 
weeks  of  this  research  effort;  consequently  no  meaningful  criticisms  or  suggestions  are  offered  at 
this  time.  The  ANM  Transport  Airplane  Directorate  plans  to  issue  the  NPRM  when  priorities 
permit. 

8.5  INDUSTRY  AND  MILITARY  PUBLICATIONS.  STANDARDS.  AND  SPECIFICATIONS. 

Although  most  relevant  industry  and  military  guidance  is  directed  specifically  toward  rotary¬ 
wing  aircraft  crashworthy  fuel  systems,  the  principles  therein  are  universally  applicable.  The 
FAA  s  adoption  of  many  industry  and  military  crashworthiness-related  standards  in  its  guidance 
for  transport  category  rotorcraft,  AC  29-2  (Series),  should  be  an  exemplar  for  adaptation  of 
known  effective  technology  to  transport  category  airplane  applications. 

8.5.1  MIL-STD-1290  (Series):  Light  Fixed-  and  Rotarv-Wing  Aircraft  Crash  Resistance. 

The  third  edition  (1971)  of  the  Crash  Survival  Design  Guide,  TR-71-22  [31],  formed  the  basis 
for  the  original  (1974)  version  of  the  U.S.  Army-sponsored  military  standard  for  “Light  Fixed- 
and  Rotary-Wing  Aircraft  Crash  Resistance,”  Military  Standard  1 290  [32], 

§5.5  of  MIL-STD-1290:  Postcrash  Fire  Protection,  established  detailed  standards  for: 

a.  Fuel  containment 

b.  Fuel  tank  design  criteria,  including  fittings  and  interconnections  for  both  main  and 
extended  range  tanks 

(1)  Fuel  lines 

(2)  Frangible  attachments 

(3)  Self-sealing  breakaway  couplings  and  valves 
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c.  Separation  of  fuel  and  ignition  sources 

d.  Separation  of  flammable  fluids  from  occupiable  areas 

e.  Barriers 

§5.5.2  contains  detailed  design  requirements  for  minimizing  susceptibility  to  postcrash  fires  from 
all  flammable  fluids. 

Appendix  A,  §10,  includes  test  methods  for  determining  qualifications  of  fuel  system 
components. 

Original  MIL-STD-1290  (January  25,  1974)  was  superseded  by  MIL-STD-1290A  on  September 
26,  1988,  [97]  which  in  turn  was  cancelled  by  the  Department  of  Defense  in  December  1995. 
There  is  currently  no  superseding  documented  standard.  Nevertheless,  the  criteria  established  by 
MIL-STD- 1 290A  are  acknowledged  to  be  the  current  state-of-the-art  of  helicopter 
crashworthiness. 

8.5.2  ADS-1 1  f  Series):  Survivability  Program.  Rotary  Wing. 

The  current  version,  ADS-11B,  was  issued  in  May  1987,  superseding  ADS- 11  A,  which  was 
issued  in  April  1976.  ADS-1  IB  is  currently  in  effect  [91]. 

§5.3,  Crashworthiness,  establishes  the  criteria  for  designers  to  address,  as  a  minimum,  structural 
crashworthiness,  occupant  retention,  injurious  environment,  postcrash  fire  potential,  and 
evacuation. 

§5.3.1  requires  that  contractors  define  their  design  concepts  for  achieving  the  levels  of 
crashworthiness  specified  in  the  System  Specification.  It  expects  descriptions  of  features, 
analyses  and  estimates  for  effectiveness  of  each  of  the  components  and  subsystems  listed  in 
Appendix  I  to  the  standard.  Appropriate  crashworthiness  tests  are  specified  in  Aeronautical 
Design  Standard  ADS-36:  “Rotary  Wing  Aircraft  Crash  Resistance.” 

Appendix  I  to  ADS-1  IB  sets  out  specific  criteria  for  evaluating  aircraft  crash  survivability. 
Postcrash  fire  potential  rating  areas  include: 

a.  Spillage  control 

( 1 )  F uel  containment 

(2)  Oil  and  hydraulic  fluid  containment 

(3)  Flammable  fluid  lines 

(4)  Firewall 

(5)  Fuel  flow  interruptors 

b.  Ignition  Control 

(1)  Induction  and  exhaust  flame  location 

(2)  Location  of  hot  metals  and  shielding 

(3)  Engine  location  and  tiedown  strength 
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(4)  Battery  location  and  tiedown  strength 

(5)  Electrical  wire  routing 

(6)  Boost  pump  location  and  tiedown  strength 

(7)  Inverter  location  and  tiedown  strength 

(8)  Generator  location  and  tiedown  strength 

(9)  Lights  location  and  tiedown  strength 

(10)  Antenna  locations  and  tiedown  strength 

110.2.  a.  is  significant  in  that  it  specifies  a  total  systems  approach  to  assigning  evaluation  ratings; 

e.g.,  “...specific  shortcomings  in  ignition  control.. .need  not  be  partially  or  totally  penalized  if 
spillage  control  is  substantiated....” 

110.2. b.  establishes  even  more  stringent  requirements  that:  “The  evaluation  will  be  conducted 
against  the  optimum  crashworthiness  criteria  stated  herein  in  lieu  of  RFP  and/or  System 
Specification  requirements  which  may  have  been  subject  to  tradeoff.” 

Detailed  criteria  for  determining  the  Postcrash  Fire  Potential  Ratings  for  the  areas  specified 
above  are  contained  in  110.2.3  of  ADS-1  IB. 

8.5.3  ADS-36:  Rotary  Wing  Aircraft  Crash  Resistance. 

Aeronautical  Design  Standard  (ADS)  36,  Rotary  Wing  Aircraft  Crash  Resistance,  was  issued  on 
1  May  1987  and  currently  remains  in  effect  [98]. 

§5.5  requires  that  aircraft  systems  be  designed  to  possess  specific  postcrash  fire  protection 
characteristics,  specified  therein.  Major  characteristics  addressed  include: 

a.  Fuel  containment 

(1)  fuel  tanks,  main 

(2)  fuel  tanks,  extended  range 

(3)  fuel  lines 

(4)  frangible  attachments 

(5)  self-sealing  breakaway  couplings/valves 

b.  Separation  of  fuel  and  ignition  sources 

c.  Separation  of  flammable  fluids  and  occupiable  areas 

d.  Shielding 

e.  Fuel  drains 

f.  Fill  units  and  access  covers 

g.  Fuel  pumps 

h.  Fuel  filters  and  strainers 

i.  Fuel  quantity  indicators 

j.  Vents 

k.  Hydraulic  and  oil  systems 

(1)  Hydraulic  and  oil  lines  and  couplings 
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(2)  Hydraulic  and  oil  systems  components 

(3)  Oil  coolers 

l.  Electrical  system 

(1)  Wiring 

(2)  Batteries  and  electrical  components 

m.  Airframe  and  interior  materials 

Appendix  A,  §10,  to  ADS-36  sets  forth  methods  for  testing  systems,  subsystems  and 
components,  including: 

a.  Fuel  tank  crashworthiness 

b.  Frangible  attachments  (static  and  dynamic  testing) 

c.  Self-sealing  breakaway  valves  (static  and  dynamic  tests) 

d.  Hose  assemblies  (fuel,  oil  and  hydraulic) 

e.  Flammability  tests  for  airframe  and  interior  materials 

f.  Full  scale  whole  aircraft  and  sectional  crash  tests 

8.5.4  Aircraft  Crash  Survival  Design  Guide  (TR-89-D-22E). 

The  most  recent  edition  of  the  U.S.  Army’s  Crash  Survival  Design  Guide  was  issued  in  1989  and 
contains  the  most  up-to-date  guidance  for  designing  crashworthy  fuel  systems  to  minimize  and 
mitigate  the  effects  of  postcrash  fires  in  its  Volume  V:  Aircraft  Postcrash  Survival  [86].  Section 
4  establishes  basic  design  guidelines  that  will  inherently  resist  flammable  fuel  spillage  and 
ignition  during  survivable  accidents.  That  objective  requires  that  designs  must  integrate  all 
potentially  contributory  aircraft  systems  by  considering  optimization  between  operational  and 
maintenance  functionality  and  crashworthiness.  The  Design  Guide’s  priority  goals  assume  the 
following  order: 

a.  Prevent  spillage;  but  if  some  does  occur,  design  to: 

b.  Prevent  ignition;  but  if  some  does  get  ignited,  design  to: 

c.  Isolate. 

8.5.5  Military  Specifications  ('MIL-SPECs). 

Numerous  military  specifications  have  been  developed  over  the  years  to  address  specific 
component  requirements  within  crashworthy  fuel  systems.  As  a  cost  savings  measure,  many 
were  cancelled  without  supersession  by  the  Department  of  Defense  during  the  1990s  in  its 
attempt  to  minimize  the  number  of  detailed  specifications  visited  upon  contractors  and  to 
transition  to  performance  specifications.  Unfortunately,  there  was  little  evaluation  of  the 
significance  of  these  cancelled  CRFS  specifications  for  their  effect  on  the  suitability,  safety,  and 
survivability  of  systems  that  might  be  procured  absent  detailed  performance  criteria.  Although 
there  is  currently  an  effort  underway  to  memorialize  the  knowledge  and  experience  of  DOD 
agencies  and  appropriate  civilian  standards  and  practices  organizations  (e.g.,  SAE  and  ASTM), 


8-29 


designers  and  procurers  of  aeronautical  systems  must  guard  that  the  current  absence  of  corporate 
memory  does  not  permit  the  loss  of  historical  lessons  so  dearly  learned. 

•  MIL-T-27422B:  Tank.  Fuel.  Crash-Resistant.  Aircraft 

Of  the  various  military  specifications  relating  to  CRFS,  the  most  significant  is 
undoubtedly  MIL-T-27422B  [30],  Although  published  in  February  1970  (Amended  in 
April  1971),  MIL-T-27422B  remains  the  most  current  specification  covering  suitable 
design  and  materials  for  fabrication  and  testing  of  crashworthy  fuel  tanks.  There  is 
currently  an  effort  by  the  SAE  G-9  Fuel  Tank  Bladder  Sub-Committee  to  reach 
consensus  on  a  new  fuel  tank  specification  (MIL-PRF-27422)  to  be  published  by  the  U.S. 
Army  that  essentially  reiterates  the  technical  details  of  MIL-T-27422B  in  a  performance 
specification. 

Other  pertinent  specifications  include: 

•  MIL-H-25579E  (current  version):  Hose  Assembly.  Tetrafluoroethvlene.  High 
Temperature.  Medium  Pressure.  General  Requirements  for 

•  MJ.L-V-27393/ A: Valve,  Safety,  Fuel  Cell  Fitting.  Crash  Resistant  General  Specification 

fol  (Cancelled,  superseded  by  SAE  Aerospace  Recommended  Practice  (ARP)-1616A 
dated  April  5,  1991.) 

•  MIL-H-38360:  Hose  Assembly,  Tetrafluoroethvlene.  High  Temperature.  High  Pressure. 
Hydraulic  and  Pneumatic  (Cancelled,  superseded  by  SAE  AS  604  and  AS  1339.) 

•  MIL-H-83796:  Hose  Assembly.  Rubber.  Lightweight.  Medium  Pressure.  General 

Specification 

8.5.6  MIL-STD-882D,  Dated  10  Feb  2000:  Standard  Practice  for  System  Safety. 

This  document  defines:  “. . .  the  system  safety  requirements  to  perform  throughout  the  life  cycle 
for  any  system,  new  development,  upgrade,  modification,  resolution  of  deficiencies,  or 
technology  development.  When  properly  applied,  these  requirements  should  ensure  the 
identification  and  understanding  of  all  known  hazards  and  their  associated  risks;  and  mishap  risk 
eliminated  or  reduced  to  acceptable  levels.  The  objective  of  system  safety  is  to  achieve 
acceptable  mishap  risk  through  a  systematic  approach  of  hazard  analysis,  risk  assessment,  and 
risk  management.  This  document  delineates  the  minimum  mandatory  requirements  for  an 
acceptable  system  safety  program  for  any  DOD  system.” 

The  specific  methodologies  and  applications  established  by  MIL-STD-882D  are  consistent  with 
the  intent  of  14  CFR  §25.1309  and  the  guidance  furnished  in  AC  23-1309-1C.  It  would  be 
appropriate  for  the  FAA  AC  guidance  to  cross-reference  to  the  MIL-STD. 
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9.  CONCLUSIONS. 


The  following  are  conclusions  reached  as  a  result  of  this  study  of  Transport  Airplane  Crash 

Resistant  Fuel  Systems. 

1.  Crash-resistant  fuel  systems  developed  and  utilized  by  the  U.S.  Army  to  safely  contain 
fuel  are  highly  effective  in  preventing  postcrash  fires  that  cause  thermal  injuries  and 
death. 

2.  Research  conducted  to  date  indicates  that  the  knowledge  surrounding  severe  but 
survivable  large  transport  aircraft  accidents  and  the  behavior  of  the  aircraft  structures  in 
those  accidents  is  not  well  known  or  understood,  due  primarily  to  the  lack  of 
crashworthiness  data  recorded  at  the  accident  scene. 

3.  Increasing  the  severity  level  of  the  large  transport  aircraft  survivable  accident  can  be 
accomplished  by  the  integration  of  much  of  the  U.S.  Army  developed  CRFS  technology 
already  in  existence,  i.e.,  rupture-resistant  tanks,  self-sealing  breakaway  valves, 
crashworthy  hoses  and  end  fittings  and  protective  placement  of  the  various  CRFS 
components  within  the  aircraft  structure. 

4.  CRFS  knowledge  and  technology  are  not  sufficient  at  this  time  to  allow  practical 
improvements  in  the  crash  resistance  of  current  integral  fuel  tanks  in  transport  airplanes. 

5.  The  integration  of  CRFS  technology  into  the  large  transport  aircraft  fleet  can  be 
accomplished  more  efficiently  and  at  a  lower  cost  and  at  reduced  weight  when  more  is 
known  about  airframe  behavior  during  the  more  severe  accidents. 

6.  The  greatest  practical  reduction  to  the  postcrash  fire  threat  could  be  achieved  with  the 
development  of  a  fuel  that  is  hard  to  spill,  but  if  spilled  is  extremely  difficult  to  ignite 
outside  the  engine,  but  if  ignited,  incorporates  self-extinguishing  characteristics.  The 
feasibility  of  the  development  of  such  a  fuel  is  unknown- 
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10.  RECOMMENDATIONS. 


The  recommendations,  based  on  this  study,  outline  the  research  efforts  which  should  be 
undertaken  by  the  FAA  and  NASA  to  support  the  development  of  improved  crash-resistant  fuel 
systems  for  large  transport  category  airplanes. 

The  following  recommendation  matrix  is  divided  into  three  sections:  Section  I  -  Level  of  Crash 
Protection  Desired:  Section  II  -  Hazard  Reduction  Methods;  and  Section  HI  -  Information 
Dissemination.  Each  of  the  three  sections  and  their  subsections  are  further  divided  into  three 
time  periods:  short  term,  mid  term,  and  long  term. 


YEARS 

I.  RECOMMENDATIONS  FOR  LEVEL  OF  CRASH 
PROTECTION  DESIRED 

Short  Term 

Mid 

Term 

Long 

Term 

1 

2 

3 

4-10 

11- 

A.  Specify  a  crash  environment  severity  for  which  occupant 
survival  is  deemed  economically  feasible  and  practical 
today: 

X 

1 .  As  more  knowledge  is  gained,  continually  reevaluate 
and  update  the  severity  levels  based  on  what  is 
practical. 

X 

X 

X 

X 

B.  Elevate  the  FAA  and  the  NTSB  accident  investigators’ 
level  of  expertise  in  the  area  of  crash  survivability,  with 
special  training  related  to  crash  kinematics,  structural 
behavior  and  the  behavior  of  the  fuel,  oil  and  electrical 
systems: 

X 

X 

X 

1 .  Develop  a  crash  survival  investigator  training  syllabus 
and  applicable  accident  investigation  forms. 

X 

2.  Conduct  training  classes  and  on-the-job  training  using 
both  test  and  nontest  crashed  aircraft. 

X 

3 .  As  more  knowledge  is  gained,  continually  update  the 
syllabus,  investigation  forms  and  the  investigative 
process. 

X 

X 

X 

C.  Using  investigators  skilled  in  the  field  of  crash 

survivability,  develop  crash  kinematic  data  for  each 
accident  to  include  impact  velocities  and  stopping  distances 
related  to  the  vertical,  longitudinal,  and  lateral  directions,  as 
well  as  typical  structural  deformation  and  displacement 
patterns  related  to  serious  but  survivable  accidents. 

X 

X 

X 

1 .  Develop  methods  to  easily  compile,  store  and  retrieve 
crash  data  for  future  use. 

X 

2.  As  more  knowledge  is  gained,  continually  update  the 
data  and  storage  and  retrieval  methods. 

X 

X 

X 

X 
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I.  RECOMMENDATIONS  FOR  LEVEL  OF  CRASH 
PROTECTION  DESIRED  (Continued) 

YEARS 

Short  Term 

Mid 

Term 

Long 

Term 

i 

2 

3 

4-10 

11- 

D.  Develop  fuel  system  hazard  analysis  methods: 

X 

1 .  Develop  and/or  revise  the  Survivability 

Hazard/Postcrash  Fire  Potential  Rating  system  similar 
to  that  found  in  Section  7. 1  of  the  final  report  “A  Study 
of  Transport  Airplane  Crash  Resistant  Fuel  Systems,” 
Robertson  Aviation,  L.L.C.  Report  No.  RA-FAA-01- 
131. 

X 

2.  Develop  and/or  revise  the  Fuel  System  Fire  Hazard 

Level  Reduction  Rating  system  similar  to  that  found  in 
Section  7.2  of  the  final  report  “A  Study  of  Transport 
Airplane  Crash  Resistant  Fuel  Systems,”  Robertson 
Aviation,  L.L.C.  Report  No.  RA-FAA-0 1-131. 

X 

3.  As  more  knowledge  is  gained,  continually  update  the 
fuel  system  hazard  analysis  methods. 

X 

X 

E.  Crash  test  large  transport  aircraft  and/or  portions  of  their 
structure  to  obtain  baseline  data: 

X 

X 

X 

X 

X 

1.  Conduct  full-scale  crash  tests  under  “crash  scenario” 
conditions  to  establish  crash  loads  and  displacements 
throughout  the  airframe  and  fuel  system. 

X 

X 

X 

X 

X 

2.  Use  data  derived  from  the  testing  proposed  above  to 
design  aircraft  section  tests  incorporating  fuel  system 
components  under  varying  impact  conditions 
incorporating  simultaneous  horizontal  and  vertical 
loading. 

i 

X 

X 

X 

X 

3.  Incorporate  instrumented  anthropomorphic  dummies 
during  testing  to  ascertain  loads  transmitted  to 
passengers  across  the  fuselage  crash  load  spectra. 

X 

X 

X 

X 

X 

4.  As  more  knowledge  is  gained,  continually  update  the 
baseline  data. 

X 

X 

X 

X 
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II.  RECOMMENDATIONS  FOR  HAZARD  REDUCTION 
METHODS 

YEARS 

Short  Term 

Mid 

Term 

Long 

Term 

1 

2 

3 

4-10 

11- 

1 .  Broaden  research  into  materials  which  can  be  used  to 
improve  integral  fuel  tank  properties  for  crash 
resistance,  fatigue  life,  ultimate  strength,  ductility, 
weight,  and  cost. 

X 

X 

X 

2.  Initiate  research  and  development  in  cooperation  with 
tank  manufacturers  to  develop  and  test  improved  crash- 
resistant  fuel  tanks  suitable  for  transport  airplanes. 

X 

X 

3 .  Initiate  research  and  development  in  cooperation  with 
valve  manufacturers  to  develop  and  test  self-sealing 
breakaway  valves  suitable  for  transport  airplanes. 

X 

X 

4.  Develop  and  test  self-sealing  breakaway  valves  for 
fuel,  vent  and  hydraulic  line  locations  where  pylon 
and/or  engine  separation  would  be  expected  to  occur. 

X 

X 

5 .  Develop  and  test  crash  resistant  bladders  or  similar  type 
concepts  suitable  for  transport  airplane  fuel  tanks. 

X 

X 

6.  Develop  and  test  frangible  fastening  methods  to  include 
bolts,  clips,  clamps,  and  other  structural  techniques 
suitable  for  use  in  transport  airplanes. 

X 

X 

7.  Develop  lightweight  crash-resistant  fuel  lines  and  end 
fittings  suitable  for  use  in  transport  airplanes. 

X 

X 

8.  As  more  knowledge  is  gained,  continually  update  the 
CRFS  component  designs  and  technology. 

X 

X 

X 

B.  Conduct  aircraft  section  tests  to  improve  analytical 

techniques  for  determining  whether  landing  gear  and 
engines  will  separate  without  damaging  wing  or  center 
fuel  tank  integrity. 

X 

1 .  Conduct  similar  tests  with  newly  designed  aircraft. 

X 

X 

II.  RECOMMENDATIONS  FOR  HAZARD  REDUCTION 
METHODS  (Continued) 

YEARS  j 

Short  Term 

Mid 

Term 

Long 

Term 

1 

2 

3 

4-10 

11- 

C.  Conduct  crash  tests  of  large  transport  aircraft  and/or 

portions  of  their  structure  containing  various  CRFS 
components  and  overall  CRFS  system  concepts  to 
determine  level  of  protection  provided. 

X 

X 

1 .  Conduct  similar  testing  with  new  aircraft  and  new 

CRFS  designs. 

X 

X 

D.  Reinstitute  research  on  the  development  of  a  fuel  that  is 

hard  to  spill,  but  if  spilled  is  extremely  difficult  to 
ignite  outside  the  engine,  but  if  ignited  would 
incorporate  self-extinguishing  characteristics. 

X 

X 

X 

X 

X 

HI.  RECOMMENDATIONS  FOR  INFORMATION 
DISSEMINATION 

YEARS  | 

Short  Term 

Mid 

Term 

Long 

Term 

1 

2 

3 

4-10 

11- 

A.  Develop  a  method  of  storing,  retrieving  and  readily 

disseminating  to  the  aerospace  community  the  usable 
knowledge  gained  during  programs  I  and  II. 

X 

B.  Prepare  design  guides,  advisory  circulars,  etc.  to 

present  useful  results  of  the  various  research  and  testing 
programs  to: 

Aircraft  designers 

FAA  rule  makers 

FAA  certification  personnel 

Aerospace  community  overall 

X 

X 

X 

C.  As  more  knowledge  is  gained,  continually  update  the 

storage  and  retrieval  system,  and  the  various  aids  used 
to  disseminate  the  information  to  the  aerospace 
community. 

X 

X 

X 

X 
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APPENDIX  A— TECHNICAL  DATA  SHEET  FOR  THE  SELF-SEALING 
BREAKAWAY  VALVE  USED  IN  THE  DC-9  AIRLINER  AUXILIARY 
FUEL  SYSTEM  FUEL  LINES— ISSUED  1 967 
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AE93093Z  SELF-SEALING  "BREAKAWAY"  FUEL  COUPLING 


CONNECTED 


BREAKAWAY  POSITION 


P/N's— AE93093Z  (Coupling  Assembly) 

AE93094Z  (Coupling  Half-Bulkhead) 

AE93095Z  (Coupling  Half-Hose  Attaching) 

Design  Specifications 

Media— Fuel 

Pressure— Operating  30  psi 

Proof  60  psi  (Coupled) 

60  psi  (Uncoupled) 

Min.  Burst  90  psi  (Coupled) 

90  psi  (Uncoupled) 

Temperoture —  — 65°F  to  -j-16Q°F 

Material— Aluminum 

Seals-BUNA-N 

Dimensions— Reference  standard  drawings 

Testing— Coupling  is  a  modification  of  the  3750  series 
which  is  approved  to  the  requirements  of  MIL-C- 
741 3A.  Pre-production  testing  is  described  in  7R 
62207D. 


Design  Features 

1.  Lightweight  because  of  all  aluminum  construction. 

2.  Internal  valve  design  provides  smooth  flow  pat¬ 
tern  and  is  identical  to  that  used  in  Aeroquip 
standard  3750  series  couplings. 

3.  The  connecting  union  nut  is  mounted  on  the  hose 
attaching  half  by  incorporating  three  (3)  shear 
pins  which  are  designed  to  break  away  at  220 
to  275  lbs.  pull.  When  rated  pull  is  achieved, 
coupling  halves  separate.  Valve  action  shuts  off 
fluid  flow  preventing  excessive  fluid  spillage. 

4.  Coupling  may  be  used  with  other  fluid  applica¬ 
tions  with  appropriate  seal  changes. 


Application  History 

Developed  for  manufacturer's  use  on  fuel  system  of  a 
commercial  aircraft.  Coupling  designed  to  separate 
upon  impact  at  an  established  force  to  effect  shut-off 
of  fuel  flow  in  inaccessible  area. 


Copyright  1967  by  Aeroquip  Corporolion 
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PLANT5:  Jackson,  Michigan 
Dallas,  Texas  /  Burbank,  California 

AEROQUIP  CORPORAT.ON,  JACKSON,  MICHIGAN  I  AEROOU1P  (CANADA)  LTD.,  Toronto  19,  Ontario 
AIRCRAFT  DIVISION  I  AEROQUIP  G.m.b.H.,  Baden  Baden,  Germany 

Specifications  subject  to  change  without  notice /  Aeroquip  Products  are  protected  by  patents  internationally 

2A  2M  1-67  Litho  in  U.S.  A. 
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APPENDIX  B— UNISSUED  ROUGH  DRAFT  OF  THE  FAA  PREPARED  NPRM  89-1 1 A 
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DRAFT  11/7/95 


[4910-13J _ 

DEPARTMENT  OF  TRANSPORTATION 
Federal  Aviation  Administration 
14  CFR  Part  25 

[Docket  No.  25890;  Notice  No.  89-11AJ 
RIN  2120-AC87 
Fuel  System  Crash  Resistance 
AGENCY:  Federal  Aviation  Administration,  DOT. 

ACTION:  Notice  of  proposed  rulemaking. 

SUMMARY:  This  notice  proposes  an  amendment  to  the  airworthiness  standards  for 
transport  category  airplanes  to  require  improved  airplane  fuel  system  crash  resistance. 
The  current  standards  would  be  amended  to  require  minimization  of  that  fuel  spillage  as 
the  result  of  following  an  accident,  be  minimized.  Methods  that  would  be  required  to 
reduce  fuel  spillage  include:  (1)  a  means  to  shut  off  the  airplane  fuel  supply  to  each 
engine  during  both  the  normal  and  emergency  shutdown  sequence;  (2)  location  of 
fuselage-  mounted  fuel  tanks  in  protected  positions  so  that  exposure  to  penetration  or 
damage  due  to  fuselage  deformation,  fuselage  separation,  or  displaced  structural  members 
is  unlikely;  (3)  a  means  to  shut  off  the  fuel  supply  to  fuel  lines  routed  outside  the  fuel 
tank  walls  during  the  takeoff  and  landing  phases  of  flight,  or  installation  of  self-sealing 
fittings  in  locations  where  damage  is  likely  during  fuselage  or  engine  separation;  and  (4) 
improved  impact  resistance  and  elongation  requirements  for  essential  fuel  lines  routed 
outside  the  fuel  tank  walls  and  located  within  or  adjacent  to  the  fuselage.  This  proposal  is 
in  response  to  the  Aviation  Safety  Research  Act  of  1988  and  is  intended  to  minimize  the 
potential  for  post-crash  fire  and  to  provide  additional  passenger  evacuation  time 
following  impact  survivable  accidents.  The  proposed  amendments  would  apply  to 
manufacturers  of  newly  designed  transport  category  airplanes. 
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DATES:  Comments  must  be  received  on  or  before  [insert  date  120  days  after  date  of 
publication] 

ADDRESSES:  Comments  on  this  proposal  may  be  mailed  in  duplicate  to:  Federal 
Aviation  Administration,  Office  of  the  Chief  Counsel,  Attention:  Rules  Docket 
(AGC-10),  Docket  No.  25890,  800  Independence  Avenue  SW.,  Washington,  DC  20591, 
or  delivered  in  duplicate  to:  Room  915G,  800  Independence  Avenue  SW.,  Washington, 
DC.  Comments  must  be  marked:  Docket  No.  25890.  Comments  may  be  inspected  in 
Room  91 5G  weekdays,  except  Federal  holidays,  between  8:30  a.m.  and  5:00  p.m.  In 
addition,  the  FAA  is  maintaining  an  information  docket  of  comments  in  the  Office  of  the 
Assistant  Chief  Counsel  (ANM-7),  Federal  Aviation  Administration,  Northwest 
Mountain  Region,  1601  Lind  Avenue  SW.,  Renton,  Washington  98055-4056.  Comments 
in  the  information  docket  may  be  inspected  in  the  Office  of  the  Assistant  Chief  Counsel 
weekdays,  except  Federal  holidays,  between  7:30  a.m.  and  4:00  p.m. 

FOR  FURTHER  INFORMATION  CONTACT:  Michael  E.  Dostert,  FAA,  Airframe 
and  Propulsion  Branch  (ANM-112),  Transport  Airplane  Directorate,  Aircraft 
Certification  Service,  1601  Lind  Avenue  SW.,  Renton,  Washington  98055-4056; 
telephone  (206)  227-2 1 32;  facsimile  (206)  227- 1 320. 

SUPPLEMENTARY  INFORMATION: 

Comments  Invited 

Interested  persons  are  invited  to  participate  in  this  proposed  rulemaking  by 
submitting  such  written  data,  views,  or  arguments  as  they  may  desire.  Comments  relating 
to  any  environmental,  energy,  or  economic  impact  that  might  result  from  adopting  the 
proposals  contained  in  this  notice  are  invited.  Substantive  comments  should  be 
accompanied  by  cost  estimates.  Commenters  should  identify  the  regulatory  docket  or 
notice  number  and  submit  comments  in  duplicate  to  the  Rules  Docket  address  specified 
above.  All  comments  received  on  or  before  the  closing  date  for  comments  will  be 
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considered  by  the  Administrator  before  taking  action  on  this  proposed  rulemaking.  The 
proposals  contained  in  this  notice  may  be  changed  in  light  of  comments  received.  All 
comments  will  be  available  in  the  Rules  Docket,  both  before  and  after  the  closing  date  for 
comments,  for  examination  by  interested  persons.  A  report  summarizing  each 
substantive  public  contact  with  FAA  personnel  concerning  this  rulemaking  will  be  filed 
in  the  docket.  Commenters  wishing  the  FAA  to  acknowledge  receipt  of  their  comments 
must  submit  with  those  comments  a  self-addressed,  stamped  postcard  on  which  the 
following  statement  is  made:  "Comments  to  Docket  No.  25890."  The  postcard  will  be 
date  stamped  and  returned  to  the  commenter. 

Availability  of  NPRM 

Any  person  may  obtain  a  copy  of  this  notice  by  submitting  a  request  to  the  Federal 
Aviation  Administration,  Office  of  Public  Affairs,  Attention:  Public  Information  Center, 
APA-230,  800  Independence  Avenue  SW,  Washington,  DC  20591,  or  by  calling  (202) 
267-3484.  Communications  must  identify  the  notice  number  of  this  NPRM.  Persons 
interested  in  being  placed  on  a  mailing  list  for  future  rulemaking  documents  should  also 
request  a  copy  of  Advisory  Circular  No.  11-2A,  Notice  of  Proposed  Rulemaking 
Distribution  System,  which  describes  the  application  procedure. 

Background 

Improving  airplane  fuel  system  crash  resistance  has  long  been  a  subject  of 
proposed  FAA  regulatory  action.  In  1964,  the  FAA  considered  adopting  standards  for 
crash-resistant  fuel  tanks,  self-sealing  breakaway  fuel  line  fittings,  and  engine  ignition 
suppression  systems  for  transport  category  airplanes.  It  was  found,  however,  that 
insufficient  technical  information  existed  at  that  time  to  provide  a  basis  for  developing 
regulatory  standards.  Subsequently,  the  FAA  considered  other  means  to  mitigate  the 
post-crash  fire  and  explosion  hazard,  such  as  fuel  tank  inerting  and  suppression  systems. 
In  response  to  a  recommendation  from  the  National  Transportation  Safety  Board  (NTSB) 
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in  1971  and  a  subsequent  petition  for  rulemaking  from  the  Aviation  Consumer  Action 
Project  (ACAP)  in  1972,  the  FAA  issued  Notice  74-16  (39  FR  12260,  April  4,  1974) 
proposing  to  require  the  installation  of  means  to  prevent  fuel  system  explosion.  As  a 
result  of  the  comments  made  in  response  to  Notice  74-16,  the  FAA  determined  that  such 
means  would  have  little  or  no  effect  in  reducing  post-crash  fire  and  explosion  hazards 
when  fuel  is  spilled  from  damaged  tanks.  It  was  also  concluded  in  a  1977  public  hearing 
that  crash-resistant,  wing-mounted  fuel  tanks  would  not  be  effective  in  view  of  the  wing 
damage  and  separations  that  had  occurred  in  several  impact-survivable  accidents.  The 
conclusions  reached  at  these  hearings  have  been  supported  by  subsequent  studies  and 
research  projects  conducted  by  the  FAA  and  industry.  As  a  result  of  the  information 
gained  from  the  public  hearing,  the  FAA  withdrew  Notice  74-16  in  1978  and  established 
the  Special  Aviation  Fire  and  Explosion  Reduction  (SAFER)  Advisory  Committee  to 
evaluate  possible  means  to  improve  survivability  in  the  post-crash  event. 

The  SAFER  Committee  consisted  of  a  chairman,  executive  director,  and  24 
representatives  spanning  the  spectrum  of  international  aviation  interests.  The  committee 
reviewed  worldwide  transport  airplane  accidents  involving  post-crash  fuel  fires  and  fuel 
tank  explosions  that  had  occurred  between  1964  to  1978  and  concluded  that  with  existing 
technology,  the  potential  for  post-crash  fires  and  explosions  could  be  reduced.  (The 
SAFER  Committee's  advice  and  recommendations  to  the  FAA  are  embodied  in  a  final 
report,  FAA-ASF-80-4,  "Final  Report  of  the  Special  Aviation  Fire  and  Explosion 
Reduction  (SAFER)  Advisory  Committee,"  dated  June  26,  1980,  a  copy  of  which  is 
contained  in  the  docket  for  this  rulemaking.) 

On  the  basis  of  available  accident  data,  the  SAFER  Committee  recommended  two 
propulsion  system  related  actions  to  amend  14  CFR  part  25  of  the  Federal  Aviation 
Regulations  (FAR).  The  first  recommendation  concerned  a  design  practice  in  use  on 
some  current  airplanes  that  provides  for  flame  arrestors  in  the  fuel  tank  vent  lines  to 
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reduce  the  likelihood  of  fuel  tank  explosion  caused  by  flame  propagation  into  the  tank 
through  the  fuel  tank  vent.  The  second  recommendation  required  closure  of  both  fuel 
tank-to-engine  and  engine  fuel  control  shutoff  valves  during  normal  engine  shutdown. 
The  Committee  considered  that  this  latter  design  practice  would  maximize  the  probability 
of  engine  fuel  supply  shutoff  in  post-crash  fire  accidents. 

The  CommitteeCommitee  also  reviewed  fuselage  fuel  system  designs  and 
determined  that  certain  industry  design  practices,  including  providing  for  displacement  of 
the  tank  without  leakage,  the  use  of  flexible  stretchable  fuel  lines,  locating  fuel  tanks 
outside  areas  where  penetration  from  displaced  structural  members  was  likely,  and 
providing  considerable  clearance  between  the  tank  and  surrounding  structure  to  minimize 
tank  damage,  provided  safe  auxiliary  fuel  tank  installations. 

To  implement  the  SAFER  propulsion  system  recommendations,  preliminary 
rulemaking  action  was  initiated.  Advance  Notice  of  Proposed  Rulemaking  (ANPRM) 
No.  84-17  was  published  in  the  Federal  Register  on  September  26,  1984  (49  FR  38078), 
for  the  purpose  of  obtaining  public  comments,  information,  and  data  relative  to  adding 
new  airworthiness  standards  applicable  to  transport  category  airplane  fuel  systems.  The 
objective  of  the  rulemaking  proposed  in  Notice  84-17  was  to  develop  airworthiness 
standards  that  would  provide  protection  against  fuel  tank  explosions  following  a  post¬ 
crash  ground  fire,  and  that  would  assure  engine  and  auxiliary  power  unit  fuel  supply 
shutoff  to  reduce  the  fire  hazard  from  spilled  fuel. 

While  the  rulemaking  for  Notice  84-17  progressed.  Congress  enacted  Public  Law 
100-591,  "Aviation  Safety  Research  Act  of  1988."  Section  9  (a)  of  that  Act  required  the 
Administrator  of  the  FAA  to  issue  an  ANPRM  to  determine  the  feasibility  of  installing,  in 
all  air  carrier  airplanes,  crashworthy  fuselage  fuel  tanks  and  fuselage  fuel  lines  that  are 
rupture  resistant  and  that  disconnect  and  seal  in  the  event  of  an  accident.  Notice  89-11 
was  published  in  response  to  that  action. 
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Notice  89-11  contained  seventeen  questions  intended  to  obtain  information 
regarding  the  economic  and  technological  feasibility,  costs  (weight/range 
reduction/hardware,  design,  maintenance),  safety  benefits,  scope,  applicability,  and 
alternatives  of  a  regulatory  change  requiring  the  installation  of  crashworthy  fuselage  fuel 
tanks  and  fuel  lines  that  are  rapture  resistant  and  that  disconnect  and  seal  in  the  event  of 
an  accident. 

Discussion  of  Comments 

Twenty-four  commenters  responded  to  the  seventeen  questions  contained  in 
Notice  89-11.  Commenters  included  the  general  public,  airplane  and  component 
manufacturers,  and  other  interested  organizations  in  the  United  States  and  Europe.  All 
commenters  agreed  with  the  desired  goal  of  reducing  post-crash  fuel  leakage;  however, 
comments  and  information  provided  in  response  to  many  of  the  questions  posed  in  the 
notice  indicated  that  more  effective  fuel  leak  minimization  can  be  achieved  by  modifying 
the  method g  djgcussed  within  the  notice,  that-the-  FAA  should  modify  tho  original 
proposal 

Crashworthy  Auxiliary  Fuel  Tanks 

_ In  regard  to  the  merits  of  proposal -to  requiring©  auxiliary  fuel  tanks  located  in  the 

fuselage  to  be  crashworthy,  commenters  opposing  the  conceptprepesal  argue  that  the 
added  cost  and  complexity  of  designing  fuselage  fuel  tanks  that  are  more  impact  resistant 
is  not  justified  based  on  a  review  of  impact  survivable  accidents.  Several  commenters, 
including  the  European  Joint  Aviation  Authorities  (JAA),  question  the  relative  benefits  of 
changing  the  current  fuselage  fuel  tank  crash  resistance  requirements.  A  JAA  review  of 
United  Kingdom  historical  data  for  a  twelve-year  period  indicates  that  although  fuel-fed 
post  impact  fires  occurred  in  a  significant  percentage  of  the  cases,  there  were  no  cases 
that  led  to  recommendations  that  fuselage  fuel  tank  crashworthiness  be  improved.  The 
JAA  also  states  that  fuselage  fuel  tanks  located  within  the  wing  center  section  are 
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normally  contained  within  a  strong  structural  framework  and  appear  to  be  effectively 
protected. 

The  FAA  agrees  with  the  JAA  findings,  which  are  supported  by  information 
contained  within  FAA  Report  No.  DOT/FAA/CT-87/18  "Fuel  Containment  Concepts- 
Transport  Category  Airplanes,"  dated  November  1987;  and  FAA  report  "Evaluation  of 
Expected  Effectivity  of  Antimisting  Fuel  in  Post  Crash  Fire  Accidents,”  1964-1983. 
(Copies  of  these  documents  are  available  in  the  docket.)  Information  within  these 
documents  indicates  that  integral  fuel  tanks  located  in  the  wing  outboard  of  the  fuselage 
and  fuel  lines  located  within  the  fuselage  are  the  main  sources  of  leakage  during  impact 
survivable  accidents.  Fuselage  fuel  tanks,  including  those  located  within  the  wing  center 
section,  were  not  identified  to  have  been  the  primary  source  of  leakage  in  any  of  the  70 
impact  survivable  accidents  reviewed. 

Two  other  commenters  stated  that  existing  industry  design  practices  and  FAA 
policy  provided  in  Advisory  Circular  25-8,  "Auxiliary  Fuel  System  Installations,"  dated 
May  5,  1986,  have  provided  for  auxiliary  fuel  tank  installations  that  have  been  effective  at 
reducing  the  post-crash  fuel  fire  hazard  from  fuselage  fuel  tanks.  The  FAA  agrees  that 
certain  design  practices  utilized  by  some  manufacturers,  such  as  the  use  of  self-sealing 
fittings,  the  use  of  flexible  stretchable  fuel  lines,  and  locating  fuel  tanks  where  damage 
from  displaced  landing  gear  or  structural  members  is  unlikely,  do  improve  the  crash 
resistance  of  fuselage-mounted  auxiliary  fuel  tank  installations.  However,  these 
practices  are  not  currently  mandated  by  the  regulations  and  are  not  utilized  by  all 
manufacturers  of  transport  category  airplanes. 

Currently  mandated  practices  include  g  25.721  (a¥Q.  which  requires  that  the  landing 
Rear  and  fuel  system  be  designed  such  that  if  the  landing  gear  fails  due  to  overloads  (in 
the  upward  and  aft  directions)  during  takeoff  and  landing,  the  failure  is  not  likely  to  cause 
"spillage  of  enough  fuel  from  any  fuel  system  in  the  fuselage  to  constitute  a  fire  hazard." 
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In  addition.  $  25.963  (d)  requires  that  fuselage  fuel  tanks  resist  rupture  and  retain  fuel 
under  the  emergency  landing  conditions  defined  in  §  25.561  and  be  "in  a  protected 
position  so  that  exposure  of  the  tanks  to  scraping  action  with  the  ground  is  unlikely." 
These  sections  do  not  address  the  SAFER  recommendations  noted  above  that  include 
providing  for  displacement  of  the  tank  without  leakage,  the  use  of  flexible  stretchable  fuel 
lines,  locating  fuel  tanks  outside  areas  where  penetration  from  displaced  structural 
members  is  likely,  and  providing  considerable  clearance  between  the  tank  and 
surrounding  structure  to  minimize  tank  damage.  The  FAA  therefore  considers  that 
amendment  of  the  regulations  is  needed  to  ensure  that  all  new  designs  meet  minimum 
crashworthiness  standards. 

Fuel  Tank  Crash  Loads 

Notice  89-11  also  requested  specific  information  regarding  what  standard  should 
be  used  for  establishing  crash  resistance  of  fuselage  fuel  tanks.  Commenters  generally 
agreed  that  Military  Specification  MIL-T-27422B,  "Tank,  Crash  Rresistant,  Aircraft," 
dated  February  24,  1970,  including  Amendment  1,  dated  April  13,  1971,  "Type  II,  non¬ 
self-sealing,  Class  A  flexible  cell  construction,"  is  a  good  starting  point  for  the 
development  of  impact  resistance  criteria  for  transport  category  airplanes.  However,  this 
specification  was  developed  for  rotorcraft  and  small  airplane  fuel  tanks  that  jure  exposed 
to  distinctly  different  crash  dynamics  than  transport  category  airplane  fuel  tanks.  These 
commenters  therefore  recommended  further  study  regarding  the  crash  dynamics  of  large 
fuel  tanks  located  in  these  types  of  airplanes. 

Although  the  SAFER  report  indicated  that  crashworthy  fuel  tanks  were  not 
considered  effective  with  respect  to  the  wing  fuel  tanks  of  transport  category  airplanes, 
the  FAA  is  conducting  a  research  and  development  program  with  auxiliary  fuselage- 
mounted  fuel  tanks  to  evaluate  possible  fuel  containment  design  criteria  and  to  determine 
whether  new  or  revised  structural  design  standards  are  necessary.  To  date,  test  results 
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show  that  fuselage-mounted  fuel  tanks  that  are  installed  utilizing  the  guidelines  provided 
in  Advisory  Circular  25-8,  "Auxiliary  Fuel  Systems  Installations,"  resist  rupture  during 
typical  impact  survivable  crash  load  conditions. 

Since  issuance  of  Notice  89-11,  the  FAA  has  requested  assistance  from  the 
Aviation  Regulation  Advisory  Committee  (ARAC)  to  assist  in  determining  what  standard 
should  be  used  for  the  dynamic  load  requirements  for  airplane  fuel  tanks.  The 
committeecommitee  is  currently  attempting  to  harmonize  the  FAR  and  Joint 
Airworthiness  Requirements  (JAR)  and  is  developing  a  recommendation  that,  if  accepted 
by  the  FAA,  will  be  the  subject  of  future  rulemaking.  Therefore,  amendment  of  the  fuel 
tank  load  requirements  is  not  addressed  in  this  notice. 

Self  Seating ;  Fittines- 

Comments  were  also  received  regarding  the  merits  of  requiring  the  installation  of 
self-sealing  fittings  in  fuselage  fuel  lines  and  the  engine  fuel  feed  lines.  One  comraenter 
stated  that  self-sealing  fittings  are  currently  in  use  in  a  number  of  fuselage-mounted 
auxiliary  fuel  tanks  in  McDonnell  Douelas  Model  DC-9  and  Model  MD-80  airplanes  and 
have  provided  satisfactory  service  experience.  The  commenter  further  stated  that  other 
methods  of  providing  fuel  system  crashworthiness  have  been  employed  by  other 
manufacturers  and  that  mandating  self-sealing  fittings  may  unnecessarily  inhibit  airplane 
fuel  system  design.  This  commenter  and  four  other  commenters  opposed  or  questioned 
installation  of  self-sealing  fittings  in  the  engine  fuel  lines  due  to  possible  inadvertent 
closure  of  the  valves  and  unwanted  loss  of  engine  power.  These  commenters  indicate 
that  inadvertent  closure  of  self-sealing  fittings  could  result  in  a  significant  increase  in 
non-restartable  engine  incidents  and  could  result  in  loss  of  power  from  more  than  one 
engine.  They  further  expressed  a  concern  that  requiring  self-sealing  fittings  could  result 
in  an  overall  reduced  level  of  safety.  However,  these  commenters  did  not  provide  factual 
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data  to  substantiate  that  new  technology  self-sealing  fittings  would  be  exposed  to  high  | 
rates  of  inadvertent  closure  and  therefore  cause  a  significant  reduction  in  airplane  safety. 

Other  commenters  referenced  the  satisfactory  service  experience  of  self-sealing 
fittings  in  military  airplanes  and  fully  supported  the  proposal  to  require  installation  of 
these  fittings  in  fuel  lines  routed  within  or  adjacent  to  the  fuselage  and  at  the  engine  to 
airframe  connection  point  Information  provided  by  one  coramenter  indicates  that  newer 
technology  self-sealing  fittings  provide  significantly  improved  reliability  and  are  designed 
to  preclude  unwanted  closure  and  will  operate  with  a  mean  time  between  failure  of 
30,000  hours.  Another  commenter  stated  that  self-sealing  fittings  have  been  in  use  for 
many  years  on  military  aircraft  and  reliability  data  is  available  from  this  source.  This 
commenter  also  commented  on  the  potential  benefits  of  correctly  installing  practical 
crashworthy  fuel  systems.  The  commenter  stated  that  "...since  1970  the  U.S.  Army  has 
experienced  approximately  3200  crashes  of  aircraft  equipped  with  crashworthy  fuel 
systems.  As  of  the  date  of  the  comment,  October  1989,  only  two  individuals  had  died  by 
fire  in  accidents  which  were  otherwise  survivable." 

Flexible  Stretchable  Fuel  Lines 

Another  fuel  containment  concept  proposed  in  Notice  89-1 1  for  which  cost  and 
benefit  information  was  requested  concerned  a  proposal  to  mandate  the  use  of  stretchable 
flexible  fuel  lines  for  all  fuel  lines  routed  within  the  fuselage  contour.  No  specific 
comments  regarding  this  proposal  were  received. 

Discussion 

Based  on  the  comments  received  in  response  to  Notice  89-1 1,  the  FAA  proposes 
to  amend  the  fuel  system  requirements  of  part  25  to  minimize  the  potential  for  fuel 
spillage  within  or  adjacent  to  the  passenger  compartment  from  fuel  sources  where  it  can 
be  shown  to  be  economically  feasible,  utilizing  currently  available  technology.  The  FAA 
has  determined  that  these  sources  include  auxiliary  fuel  tanks  located  within  the  fuselage 
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contour  and  fuel  lines  routed  outside  the  fuel  tanks  within  or  immediately  adjacent  to  the 
passenger  cabin.  Examples  of  such  fuel  line  routings  include  fuel  lines  routed  above  or 
below  the  passenger  cabin  floor,  and  fuel  lines  routed  along  the  external  fuselage  skin 
within  fairings.  Fuel  lines  that  are  addressed  include  those  lines  that  feed  fuel  to  both 
essential  systems,  such  as  the  engines  and  essential  Auxiliary  Power  Units  (APIPs),  and 
those  that  feed  non  essential  systems,  such  as  airplane  center  of  gravity  trim  fuel  tanks, 
and  non  essential  APU’s. 

This  notice  of  proposed  rulemaking  contains  four  proposals.  The  first,  to  add  a 
new  paragraph  (i)  to  §  25.1189,  would  implement  the  SAFER  committee 
recommendation  to  require  closure  of  the  airframe  mounted  engine  fuel  shutoff  valve 
when  either  the  normal  or  emergency  engine  shutdown  procedure  is  carried  out  by  the 
flightcrew.  Currently,  manufacturers  of  most  transport  category  airplanes  activate  the 
airplane  mounted  fuel  shutoff  valve  via  the  normal  fuel  shutoff  levers.  Therefore,  this 
proposal  is  not  expected  to  have  a  significant  cost  impact.  As  discussed  earlier  in  this 
notice,  the  fuel  feed  shutoff  provisions  were  originally  proposed  in  Notice  84-17.  No 
adverse  comments  were  received  to  that  proposal  in  response  to  Notice  84-17.  Those 
provisions  have  now  been  incorporated  in  this  rulemaking,  which  the  FAA  anticipates 
will  more  completely  address  the  threat  from  fuel  leakage  following  a  survivable  crash 
landing. 

The  second  proposal  would  amend  §  25.963(d)  to  add  a  requirement  to  locate  fuel 
tanks  that  are  within  the  fuselage  contourrequire  fuel-  tanks  located  within  thp  feselage 
contour  to  be  in  a  protected  location  so  that  exposure  to  penetration  or  damage  due  to 
fuselage  deformation,  fuselage  separation,  ordisplaced  structural  members  (including  the 
landing  gear)rand  scraping  action  with  tho  ground  is  unlikely.  The  intended  compliance 
methods  for  these  additional  requirements  would  include  analysis  of  the  fuselage 
auxiliary  fuel  tank  installation  under  impact  survivable  crash  conditions  that  exceeded  the 
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bads  defined  in  <j  11  SM  (hi  to  show  that  the  fuel  tankage  is  not  located  where  tolans 
-Puerto.  nr  damage  from  displaced  structural  members  is  likely  to  occur.  In  addition. 
analysis  would  be  ~m.in-d  to  show  that  damage  to  auxiliapr  M  tanks  did  not  occur 

....  ip  whum  dcfc— d - - shins  ths.  would  occur  during  the  loading  conditions 

d.r,nod  in  6  2S  mn.v  This  goessaL  a  consistent  with  guidance  provided  in  FAA 
a  a,ri.„rv  rircilar  1.0  7V8.  Auxilary  Fuel  System  Installations,  for  determininiUhe 
■a., - f  fi.wla.e  deformation  o'  structural  crush  distance  that  should  he  available  to 

avoid  auxiliary  fuel  tank  ground  contact 

_ This  proposal  would  apply  to  fuel  tanks  and  portions  of  fuel  tanks  located  within 

the  fuselage  contour,  such  as  those  tanks_locatcd  within  the  wing  center  section,  vertical 
and  horizontal  stabilizer,  and  cargo  compartment,  and  would  mandate  practices  currently 


in  use  by  most  manufacturers  for  installation  of  auxiliary  fuel  tanks. 

The  third  proposal  would  amend  §  25.993  to  add  a  new  paragraph  (g)  to  require 
that  fuel  sources  for  fuel  lines  routed  outside  the  fuel  tank  walls  to.be  shut  offjromjhe 
a..i  during  the  takeoff  and  landing  portions  of  flight,  or  tohave  automatic  luel 

shutoff  capability  during  fuselage  or  engine  separation.  The  use  of  self-sealing  fitbngs 
would  be  one  option  available  to  the  applicant  to  satisfy  the  proposed  fuel  shutoff 

requirement.  Commenters  should  address  the  weight,  cost,  and  safety  benefits,  including 

the  effects  on  unwanted,  non-restartable  engine  shutdown  rates,  of  installing  new 


technology  self-sealing  fittings . 

The  fourth  proposal  would  revise  §  25.993(f)  to  require  that  fuel  lines  routed 
outside  the  fuel  tank  walls,  and  within  or  adjacent  to  the  fuselage,  be  designed  and 


installed  to  resist  rupture  when  the  line  is  stretched  and  deformed  by  adjacent  structure 
during  fuselage  separation.  Fueljmes. currently  available  and  utilized  by  spmg 
manufacturers  have  ^onstrated  impact  resistance  during  guillotine  tests,  with  feline 
-  *  neratine  nresures  and  temperatures  that  resulted  in  elongation  of,  ueJoJO 


iercent  of  their  original  length  without  leakage.  This  level  of  impact  resistance  and 
elongation  capability  is  considered  by  the  FAA  to  meet  the  intent  of  this  proposal. 
Specific  methods  of  compliance  with  this  requirement  would  would  be  describedfined  in 
a  new  advisory  circular  developed  for  that  purpose. 

The  proposal  to  amend  §  25.993(f)  to  require  minimum  elongation  and 
deformation  requirements  for  fuselage  fuel  lines  is  based  on  service  experience. 
Currently,  §  25.993(0  requires  "each  fuel  line  within  the  fuselage  to  be  designed  and 
installed  to  allow  a  reasonable  degree  of  deformation  and  stretching  without  leakage." 
Compliance  with  this  rule  does  not  require  consideration  of  the  degree  of  deformation 
and  stretching  that  has  occurred  during  separation  of  the  fuselage  and  does  not  apply  to 
fuel  lines  routed  outside  the  fuselage  adjacent  to  the  passenger  compartment  (such  as  fuel 
lines  routed  through  fairings).  A  review  of  the  accident  statistics  developed  by  the 
National  Transportation  Safety  Board,  and  contained  within  the  SAFER  report,  for  the 
period  from  1969  to  1978  indicates  that  14  out  of  27  survivable  transport  airplane 
accidents  resulted  in  major  fuselage  structural  damage  in  which  the  airframe  separated 
into  three  or  more  sections.  In  many  of  these  accidents,  the  fuselage  sections  remained 
within  close  proximity  to  one  another  such  that  flexible  fuel  lines  would  reduce  the 
likelihood  of  fuel  leakage. 

_ One  accident  in  which  damage  to  the  fuel  lines  routed  within  the  fuselage  was 

considered  to  have  contributed  to  the  severity  of  the  accident  occurredoccured  in 
November  1 966  in  Salt  Lake  City  and  involved  a  Boeing  727  airplane.  In  this  accident, 
fuselage  separation  resulted  in  severing  of  the  three  main  engine  aluminum  fuel  lines  and 
shrouds  that  were  routed  from  the  wing  fuel  tanks  through  the  fuselage  to  the  aft  engine 
locations.  Fuel  from  the  failed  lines,  which  was  pumped  into  the  fuselage  area,  was 
determined  to  be  a  contributing  factor  in  the  severity  of  the  accident.  The  aircraft 
manufacturer  incorporated  new  technology  fuel  lines  into  Model  727  airplanes 
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manufactured  after  1966,  and  made  retrofit  of  the  lines  available  by  service  bulletin. 
Those  fuel  lines  exhibit  greatly  improved  elongation  characteristics  and  have  been  shown 
by  service  experience  to  reduce  fuel  spillage.  A  review  of  available  service  history 
information  from  accidents  where  fuselage  separation  occurred  on  airplanes  equipped 
with  the  new  technology  lines  indicates  greatly  improved  deformation  and  stretching 
capability  is  provided  by  the  new  lines. 

One  accident  that  clearly  demonstrates  the  benefits  of  the  new  technology  fuel 
lines  occurred  in  1975  at  Stapleton  International  Airport  in  Denver,  Colorado,  where  a 
Boeing  727  airplane  equipped  with  the  new  fuel  lines  impacted  the  ground  due  to 
windshear.  The  NTSB  accident  report,  NTSB-AAR-76-14,  indicates  that  the  fuselage 
separated  into  three  pieces,  resulting  in  elongation  of  the  three  main  engine  fuel  lines. 
Due  to  damage  to  the  engine  controls  and  loss  of  electrical  power,  the  engines  could  not 
be  shut  down  and  remained  operating  at  a  high  power,  governed  only  by  the  reduced  fuel 
flow  to  the  engine  caused  by  elongation  of  the  fuel  lines.  Shutdown  of  the  engines  could 
only  be  achieved  when  ground  crews  sprayed  fire  extinguishing  foam  into  the  engine 
inlets.  No  fatalities  due  to  fuel  fire  resulted  from  this  accident. 

Notice  89-1 1  contained  a  four-part  question  requesting  comments  regarding  what 
airplanes  should  be  affected  by  a  proposed  regulatory  standard  requiring  impact-resistant 
auxiliary  fuselage  fuel  tanks  and  self-sealing  fittings.  Commenters  indicated  that  the 
applicability  of  any  new  standard  should  be  based  on  a  cost  benefit  evaluation.  All 
commenters  agreed  that  the  new  standards  should  apply  only  to  new  airplanes  for  which 
the  application  for  original  type  certification  is  made  after  the  effective  date  of  the 
amendment.  Commenters  generally  did  not  support  amendment  of  parts  121  and  135  to 
require  all  airplanes  operated  or  manufactured  after  a  specified  date  to  meet  the  new 
standards,  regardless  of  the  date  of  application  for  type  certification.  The  FAA  agrees  and 

14 


B-15 


proposes  that  the  new  standards  apply  only  to  newly  designed  transport  category 
airplanes. 

Regulatory  Evaluation 
(To  be  provided  by  APO) 

Federalism  Implications 

The  regulations  proposed  herein  would  not  have  substantial  direct  effects  on  the 
States,  on  the  relationship  between  the  national  government  and  the  States,  or  on  the 
distribution  of  power  and  responsibilities  among  the  various  levels  of  government. 
Therefore,  in  accordance  with  Executive  Order  12612,  it  is  determined  that  this  proposal 
would  not  have  sufficient  federalism  implications  to  warrant  the  preparation  of  a 
Federalism  Assessment. 

Paperwork.  Reduction  Act 

_ In  accordance  with  the  Paperwork  Reduction  Act  of  1990  C44  U.S.C.  3501  et 

seq.h  there  are  no  reporting  or  recordkeeping  requirements  associated  with  this  final  rule. 

Conclusion 

Because  the  installation  of  fuel  systems  with  improved  crash  resistance  is  not 
expected  to  result  in  a  substantial  economic  cost,  the  FAA  has  determined  that  this 
proposed  regulation  is  not  significant  under  Executive  Order  12866.  However,  the  FAA 
considers  this  action  to  be  significant  as  defined  in  Department  of  Transportation 
Regulatory  Policies  and  Procedures  (44  FR  11034,  February  26,  1979),  as  it  involves  a 
matter  on  which  there  has  been  significant  public  interest.  In  addition,  it  has  been 
determined  under  the  criteria  of  the  Regulatory  Flexibility  Act  that  this  regulation,  at 
promulgation,  would  not  have  a  significant  economic  impact,  positive  or  negative,  on  a 
substantial  number  of  small  entities,  since  none  would  be  affected.  A  copy  of  the  initial 
regulatory  evaluation  prepared  for  this  proposal  may  be  examined  in  the  public  docket  or 
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obtained  from  the  person  identified  under  the  caption,  "FOR  FURTHER 
INFORMATION  CONTACT." 

List  of  Subjects  in  14  CFR  part  25 

Aircraft,  Aviation  safety.  Federal  Aviation  AdmmistratiotvReporting  and  record- 
keeping  requirements. 

The  Proposed  Amendment 

Accordingly,  the  Federal  Aviation  Administration  proposes  to  amend  14  CFR  part 
25  of  the  Federal  Aviation  Regulations  (FAR)  as  follows: 

PART  25  -  AIRWORTHINESS  STANDARDS:  TRANSPORT  CATEGORY 
AIRPLANES. 

1 .  The  authority  citation  for  part  25  continues  to  read  as  follows: 

Authority:  49  U.S.C.  aPP-  1311,  1351(a),  1-355,  1121,  H23,  1121,  1125,  1428, 

1430;  49  U.S.C.  1  nA(c);  and  40  CFR  1.47ririr.  40113.  44701,  44702,  44704.. 

2.  Section  25.963  would  be  amended  by  revising  paragraph  (d)  to  read  as  follows: 

§  25.963  Fuel  tanks:  General 
*  *  *  *  * 

(d)  Fuel  tanks  within  the  fuselage  contour  must  be  able  to  resist  leakage  and  to 
retain  fuel,  under  the  inertia  forces  prescribed  for  the  emergency  landing  conditions  of 
§25.561.  In  addition,  these  tanks  must  be  located  in  a  protected  position  so  that 
exposure  to  penetration  or  damage  due  to  fuselage  deformation,  fuselage  separation, 
displaced  structural  members  (including  the  landing  gear),  and  scraping  action  with  the 
ground  is  unlikely. 

3.  Section  25.993  would  be  amended  by  revising  paragraph  (f)  and  by  adding  a  new 
paragraph  (g)  to  read  as  follows: 

§  25.993  Fuel  system  lines  and  fittings. 

***** 
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(0  Each  fuel  line  routed  outside  the  fuel  tank  walls,  and  within  or  adjacent  to  the 
fuselage,  must  be  designed  and  installed  to  resist  leakage  when  the  line  is  stretched  and 
deformed  by  adjacent  structure  during  fuselage  separation.  This  capability  must  be 
shown  with  the  fuel  line  at  the  environmental  and  operating  conditions  determined  to  be 
critical. 

(g)  Each  fuel  line  that  is  routed  outside  the  fuel  tank  walls  must  provide  a  means 
to  either, 

(1)  shut  off  the  supply  of  fuel  during  takeoff  and  landing,  or 

(2)  have  an  automatic  means  to  shut  off  the  fuel  supply  during  fuselage  or  engine 
separation. 

***** 

4.  Section  25.1189  would  be  amended  by  adding  a  new  paragraph  (i)  to  read  as 
follows: 

§  25. 1 1 89  Shutoff  means 
***** 

(i)  The  airframe-mounted  engine  and  auxiliary  power  unit  (APU)  fuel  shutoff 
valves  must  isolate  the  airplane  fuel  supply  from  the  engine  and  APU  during  both  the 
normal  and  emergency  shutdown  sequence. 

Issued  in  Washington,  D.C.  on 


f:\horne\mdostert\arac\nprms\fuel54.doc 

10/2 1/93 -.revised  by  ps/ns/mdl0/27/93:ps/mdl/19/94:copy  sent  via  cc:mail  to  APO 

(Won)  for  review,  at  request  of  Ward  Keech 

3/17/94:revised  per  MED 

10/21/94:revised  per  Doug's  comments 

7/28/95:ps:editorial  review . 

8/2/95  :ps:editorial  changes  accepted 
9/27/95:  revised  per  Doug's  comments 
1 1/7/95  :editorial  review  of  previous  version 
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APPENDIX  C— FUEL  SYSTEM  DESIGN  CHECKLIST 


C-l 


FUEL  SYSTEM  DESIGN  CHECKLIST 


The  following  fuel  system  design  checklist  is  Section  6.9  of  Chapter  6,  Volume  I  of  the 
U.S.  Army  Aircraft  Crash  Survival  Design  Guide,  USAAVSCOM  TR  89-0-22A  Dec 
1989. 

6.9  DESIGN  CHECKLISTS 

6.9.1  Fuel  System  Design  Checklist 

6. 9. 1.1  Fuel  Tanks 


1.  Are  the  fuel  tanks  located  as  far  as  possible  from  anticipated  impact 
areas,  occupiable  areas,  large  weight  masses,  and  primary  ignition 
sources? 

2.  Are  the  fuel  tanks  located  as  high  up  in  the  structure  as  possible? 

3.  Are  the  fuel  tanks  located  where  there  is  not  danger  of  puncture  by  a 
collapsing  landing  gear? 

4.  Are  the  fuel  tanks  located  so  that  transmissions,  engines,  and  similar 
massive  components  will  not  crush  the  tanks  during  a  crash? 

5.  Are  the  fuel  tanks  relatively  safe  from  penetrative  damage  by  structural 
stringers  and  stiffeners? 

6.  Can  each  fuel  tank  displace  in  the  airframe  structure  without  tearing  or 
inducing  leaks  around  the  filler  area,  the  fuel  line  entry  and  exit,  the 
quantity  indicator,  and  the  tank-to-structure  attachment  points? 

7.  Do  the  fuel  tanks  have  smooth,  regular  shapes,  with  the  sump  gradually 
contoured  into  the  tank  bottom? 

8.  Do  all  fuel  tank  concave  corners  have  a  minimum  radius  of  3  in.,  and  all 
convex  corners  a  minimum  radius  of  1  in.? 

9.  Do  all  fuel  tanks  meet  or  exceed  the  requirements  of  MIL-T-27422B? 

10.  Do  all  fuel  tank  fittings  meet  or  exceed  the  tank  pullout  strength  specified 
in  MIL-T-27422B? 
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6.9. 1.2  Fuel  Lines 


11.  Are  all  fuel  lines  made  from  flexible  hose  with  a  steel-braided  outer 

sheath? 

12.  Do  all  hose  assemblies  meet  the  strength  requirements  listed  in  Table  17, 
Section  6.2.3.1  of  the  Crash  Survival  Design  Guide  (last  page  of  this 
checklist)? 

13.  Can  all  hoses  elongate  20%  without  the  hose  assemblies  spilling  fuel? 

1 4.  Do  fuel  lines  exit  the  fuel  tank  in  one  protected  location? 

15.  Has  the  number  of  fuel  lines  in  the  engine  compartment  been  kept  to  a 
minimum? 

16.  Are  fuel  lines  routed  along  heavier  structural  members  wherever 
possible? 

1 7.  Is  as  much  of  the  fuel  line  as  possible  routed  through  the  fuel  tanks? 

18.  Are  fuel  lines  routed  as  far  as  possible  from  occupiable  areas  and 
electrical  compartments? 

19.  Are  fuel  lines  routed  as  far  as  possible  from  all  electrical  equipment  and 
wires? 

20.  Are  fuel  lines  routed  away  from  areas  where  large  structural  damage  is 
likely  during  a  crash? 

21 .  Are  fuel  lines  routed  away  from  the  exhaust  system  and  high-temperature 
heating  ducts? 

22.  Are  the  fuel  system  lines  designed  with  as  few  fittings  as  possible? 

23.  Are  the  fuel  system  lines  designed  so  that  uncut  hoses  are  run  through 
bulkheads  rather  than  attached  to  the  bulkheads  with  fittings? 

24.  Are  self-sealing  breakaway  valves  used  wherever  a  fuel  line  goes  through 
a  firewall  or  bulkhead  or  is  attached  to  the  bulkhead? 

25.  Are  lines  entering  and  exiting  in-line  boost  pumps  made  of  flexible  hose 
that  is  approximately  20%  longer  than  necessary? 

26.  If  fuel  lines  are  not  longer  than  necessary  for  in-line  boost  pumps,  are 
self-sealing  breakaway  valves  used  in  the  lines  near  the  boost  pump? 
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27.  Are  self-sealing  breakaway  valves  used  at  all  points  in  the  fuel  lines  where 
aircraft  structural  deformation  could  lead  to  line  failure? 

28.  Are  fuel  line  supports  frangible  to  ensure  release  of  the  line  from  the 
structure  during  crash  impact? 

29.  Will  the  frangible  supports  meet  all  operational  and  service  loads  of  the 
aircraft? 

30.  Are  all  continuous  lines  running  through  bulkheads  stabilized  bv  franqibie 
panels? 

6.9.1. 3  Frangible  Attachments 

31 .  Are  frangible  attachments  used  at  all  attachment  points  between  the  fuel 
tanks  and  aircraft  structure? 

32.  Do  the  specified  frangible  tank  attachment  separation  loads  exceed  all 
operational  and  service  loads  by  a  satisfactory  margin? 

33.  Are  the  specified  frangible  attachment  separation  loads  between  25% 
and  50%  of  the  loads  required  to  fail  the  attached  system  or 
components? 

34.  Will  the  frangible  attachments  separate  whenever  the  required  loads  are 
applied  in  all  possible  modes  likely  to  occur  during  crash  impacts? 

6.9. 1.4  Self-Sealing  Breakaway  Valves 

35.  Are  breakaway  valves  installed  in  all  fuel-tank-to-fuel-line  connections, 
tank-to-tank  interconnects,  and  at  other  points  in  the  fuel  system  where 
aircraft  structural  deformation  could  lead  to  system  failure? 

36.  Are  the  shapes  of  the  breakaway  valves  remaining  in  the  fuel  tank 
basically  smooth? 

37.  Are  the  breakaway  valves  recessed  into  the  tank  wall  so  that  the  tank  half 
does  not  protrude  outside  the  tank  wall  more  than  34  inch  after  valve 
separation? 

38.  Do  the  specified  breakaway  valve  separation  loads  exceed  all  operational 
and  service  loads  of  the  aircraft? 

39.  Are  the  specified  breakaway  valve  separation  loads  between  25%  and 
50%  of  the  loads  required  to  fail  the  attached  components  or  lines? 
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40.  Are  the  breakaway  valves  required  to  separate  whenever  the  required 
loads  are  applied  in  the  modes  most  likely  to  occur  during  crash 
impacts? 

6.9.1 .5  Fuel  Drains 

41.  Are  all  fuel  line  drain  valves  stabilized  where  necessary  with  frangible 
attachments? 

42.  Are  all  structural  attachments  of  fuel  tank  drains  made  with  frangible 
attachments? 

43.  Are  all  fuel  tank  drains  recessed  into  the  tank  so  that  no  part  of  the  drain 
protrudes  outside  the  tank  wall? 

6.9.1 .6  Filler  Units 

44.  Are  filler  units  attached  to  the  aircraft  structure  with  frangible 
attachments? 

45.  Are  Filler  caps  recessed  into  the  fuel  tank  wall? 

46.  Are  long  filler  necks  avoided? 

47.  If  filler  necks  are  used,  are  they  made  from  frangible  materials  and 
designed  so  that  the  filler  cap  stays  with  the  tank  after  filler  neck 
separation? 

6. 9. 1.7  Boost  Pumps 

48.  Can  an  engine-mounted,  engine-driven  boost  pump  be  used  in  the 

aircraft? 

49.  If  an  engine-mounted  suction  system  cannot  be  used,  can  an  air-driven 
boost  pump  be  used? 

50.  Do  in-line  boost  pumps  have  a  structural  attachment  capable  of 
withstanding  a  30-G  load  applied  in  any  direction? 

51 .  Are  tank-mounted  boost  pumps  fastened  to  the  structure  with  frangible 
attachments? 


4 


C-5 


6.9.1. 8 


Fuel  Fitters  and  Strainers 


52.  Are  fuel  filters  and  strainers  mounted  outside  the  engine  compartment 
wherever  possible? 

53.  Do  all  strainers  and  filters  have  a  structural  attachment  capable  of 
withstanding  a  30-G  load  applied  in  any  direction? 

54.  Do  all  strainers  and  filters  retain  as  small  a  quantity  of  fuel  as  possible? 

6.9. 1.9  Fuel  Valves 

55.  Has  the  number  of  fuel  valves  been  kept  to  the  minimum  required  for 
operation? 

56.  Are  self-sealing  breakaway  valves  used  at  all  valve-to-fuel-line 
connections  where  crash-induced  line  failure  is  likely? 

57.  Are  all  small  in-line  valves  fastened  to  the  structure  with  frangible 
attachments? 

58.  Do  large  valves  have  a  structural  attachment  capable  of  withstanding  30- 
G  loads  in  any  direction? 

59.  Are  fuel  shut-off  valves  located  outside  the  engine  compartment,  either 
on  the  outside  face  of  the  firewall  or  at  the  fuel  tank  outlets? 

6.9.1.10  Fuel  Quantity  Indicators 

60.  Can  float-type  quantity  indicators  be  used  in  this  fuel  system? 

61 .  If  probe-type  indicators  are  used,  are  they  fabricated  from  material  that 
either  is  frangible  or  possesses  as  low  a  flexural  rigidity  as  possible? 

62.  Is  a  slightly  rounded  shoe  incorporated  at  the  probe  bottom  end  of  all 
probe-type  indicators,  or  is  the  probe  mounted  at  an  angle  toward  the 
rear  of  the  aircraft? 

63.  Are  frangible  attachments  used  where  it  is  necessary  to  stabilize  the 
indicator  by  fastening  it  to  the  structure? 

6.9.1.11  Vent  Systems 

64.  Are  high-strength  fittings  used  between  the  metal  insert  in  the  tank  and 
the  vent  line? 
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65.  If  vent  outlets  must  be  supported,  are  they  supported  by  frangible 
attachments  to  the  structure? 

66.  Is  the  vent  line  made  of  wire-covered  flexible  hose? 

67.  Is  the  vent  line  routed  so  that  it  cannot  be  snagged  in  displacing  structure 
during  a  crash? 

68.  Is  a  self-sealing  breakaway  valve  used  at  the  tank-to-line  attachment  if 
there  is  danger  of  the  tank  being  torn  free  of  the  supporting  structure? 

69.  Are  vent  lines  routed  inside  the  fuel  tank  in  such  a  manner  that  spillage 
cannot  continue  after  a  rollover  accident? 

70.  If  an  antispillage  vent  valve  is  used  inside  the  tank  in  lieu  of  the  above 
items,  will  the  valve  remain  fully  open  during  all  normal  flight  conditions? 

71.  Will  the  vent  valve  close  in  the  extreme  attitudes  that  will  occur  during  a 
rollover? 

72.  Will  the  vent  valve  possess  adequate  venting  cap  ability  under  critical 
icing  conditions  in  flight? 

73.  If  the  fuel  system  is  to  be  pressure  refueled,  is  a  bypass  system  provided 
in  case  of  tank  overpressurization? 

74.  Is  any  spillage  due  to  tank  overpressurization  released  away  from  aircraft 
occupants  and  ignition  sources? 


6.9.2  Oil  and  Hydraulic  System  Design  Checklist 
6.9.2.1  Oil  Tanks  and  Hydraulic  Reservoirs 

1 .  Are  the  tanks  and  reservoirs  located  as  far  as  possible  from  anticipated 
impact  areas,  occupiable  areas,  large  weight  masses,  and  primary 
ignition  sources? 

2.  Are  the  tanks  and  reservoirs  located  as  high  up  in  the  structure  as 
possible? 

3.  Are  the  tanks  and  reservoirs  located  where  there  is  no  danger  of  puncture 
from  a  collapsing  landing  gear? 

4.  Are  the  tanks  and  reservoirs  located  where  transmissions,  engines,  and 
similar  massive  components  will  not  crush  them  during  a  crash? 
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5  Are  the  tanks  and  reservoirs  relatively  safe  from  penetrative  damage  by 
structural  stringers  and  stiffeners? 

6.  Can  the  oil  tanks  displace  in  the  airframe  structure  and  still  not  leak 
around  the  filler  area,  the  fluid  line  entry  and  exit,  the  quantity  indicator, 
and  the  tank-to-structure  attachment  points? 

7.  Are  the  hydraulic  reservoirs  constructed  and  mounted  to  withstand  30-G 
forces  applied  in  any  direction? 

6. 9. 2. 2  Oil  and  Hydraulic  Lines 

8.  Are  all  oil  and  hydraulic  lines  made  from  flexible  hose  with  a  steel-braided 
outer  sheath  wherever  possible? 

9.  Do  all  hose  assemblies  meet  the  strength  requirements  listed  in  Table  17, 
Section  6. 2. 3.1  of  the  Crash  Survival  Design  Guide  (last  page  of  this 
checklist)? 

10.  Can  all  hoses  elongate  20%  without  the  hose  assemblies  spilling  fluid? 

11.  Is  coiled  metal  tubing  used  in  areas  where  flexible  hose  cannot  be  used, 
but  large  structural  deformations  are  expected? 

1 2.  Has  the  number  of  fluid  lines  in  the  engine  compartment  been  held  to  a 
minimum? 

13.  Are  fluid  lines  routed  along  heavier  structural  members  wherever 
possible? 

14.  Are  fluid  lines  routed  as  far  as  possible  from  occupiable  areas  and 
electrical  compartments? 

15.  Are  fluid  lines  routed  as  far  as  possible  from  all  electrical  equipment  and 
wires? 

16.  Are  fluid  lines  routed  away  from  areas  where  large  structural  damage  is 
likely  during  a  crash? 

17  Are  fluid  lines  routed  away  from  the  exhaust  system  and  high- 
temperature  heating  ducts? 

18.  Are  the  fluid  system  lines  designed  with  as  few  fittings  as  possible? 
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19.  Are  the  fluid  system  lines  designed  so  that  continuous  hoses  are  run 
through  bulkheads  rather  than  attached  to  the  bulkheads  with  fittings? 

20.  Are  self-sealing  breakaway  valves  used  wherever  a  fluid  line  goes  through 
a  firewall  or  a  bulkhead  or  is  attached  to  the  bulkhead? 

21.  Are  self-sealing  breakaway  valves  used  at  all  points  in  the  fluid  lines 
where  aircraft  structural  deformation  could  lead  to  line  failure? 

22.  Are  fluid  line  supports  frangible  to  ensure  release  of  the  line  during  crash 
impact? 

23.  Are  uncut  lines  running  through  bulkheads  stabilized  by  frangible  panels? 

6. 9. 2.3  Oil  and  Hydraulic  System  Components 

24.  Are  all  oil  and  hydraulic  system  components  located  as  far  as  possible 
from  anticipated  impact  areas,  occupiable  areas,  and  electrical 
compartments? 

25.  Are  the  components  located  in  the  engine  compartment  restricted  to 
those  absolutely  necessary  for  engine  operation? 

26.  Can  the  construction  and  mounting  of  all  system  components  withstand 
30-G  forces  applied  in  any  direction  without  leakage? 

6. 9. 2. 4  Oil  Coolers 

27.  Is  the  oil  cooler  located  outside  of  the  engine  compartment? 

28.  Is  the  oil  cooler  located  as  far  as  possible  from  anticipated  impact  areas, 
occupiable  areas,  and  other  potentially  injurious  components? 

29.  Can  the  oil  cooler  and  connecting  lines  experience  considerable 
deformation  without  leaking? 

30.  Can  the  oil  cooler  mounting  withstand  30-G  forces  applied  in  any 
direction? 

6.9.3  Ignition  Source  Control  Checklist 

6. 9. 3.1  Electrical  Systems 

1 .  Are  wires  routed  as  high  up  in  the  structure  as  possible? 
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2.  Are  wires  routed  away  from  areas  of  anticipated  structural  damage,  i.e., 
landing  gear  failure,  nose  crush-in,  etc.? 

3.  Are  wires  routed  above  or  away  from  flammable  fluid  lines? 

4.  Are  all  wires  routed  through  the  structure  so  that  extensive  structural 
collapse  or  displacement  can  take  place  without  breaking  wiring? 

5.  Are  wire  bundles  supported  at  frequent  intervals  by  frangible  attachments 
to  the  aircraft  structure? 

6.  Are  wires  shielded  by  felt  or  similar  protective  covers  in  areas  where 
crushing  is  likely? 

7.  Are  wires  to  electrically  operated  boost  pumps  20%  to  30%  longer  than 
necessary? 

8.  Is  all  electrical  wiring  going  through  the  fuel  tank  compartments 
shrouded? 

9.  Is  wiring  in  the  fuel  tank  compartment  routed  as  high  as  possible  in  the 
compartment? 

10.  Are  electrical  wires  in  the  fuel  tank  compartment  20%  to  30%  longer  than 
necessary? 

11.  Are  batteries,  generators,  and  inverters  located  in  areas  relatively  free 
from  structural  collapse? 

12.  Are  batteries,  generators,  and  inverters  located  as  far  as  possible  from 
flammable  fluids? 

13.  Are  batteries  and  generators  (unless  engine  mounted)  housed  in 
compartments  built  into  the  airframe? 

14.  Are  battery,  inverter,  and  generator  mountings  capable  of  withstanding  a 
30-G  force  applied  in  any  direction? 

15.  Are  the  wires  connecting  the  generator,  battery,  and  inverter  into  the 
system  located  in  relatively  crush-free  areas? 

16.  Are  light  bulbs  and  attaching  wires  on  lower  airframe  surfaces  designed 
to  readily  displace,  rather  than  remain  stationary  and  be  broken? 

17.  Are  all  electrical  compartments  lined  with  a  tough,  nonconductive 
paneling? 
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6. 9. 3. 2  Shielding 

18.  Are  fuel  tanks  isolated  from  the  occupants  by  a  minimum  of  two  spillage 
barriers? 

19.  Are  firewalls  designed  to  withstand  all  survivable  crash  impacts  without 
losing  their  structural  integrity  or  sealing  ability? 

20.  Are  drainage  holes  located  in  all  flammable  fluid  tank  compartments? 

21 .  Is  the  hot  metal  of  the  engine  shielded  from  flammable  fluid  spillages? 

6.9.4  Interior  Materials  Selection  Checklist 

1.  Do  all  interior  materials  meet  the  flammability  requirements  specified  in 
the  current  Federal  Air  Regulation? 

2.  Do  all  interior  materials  produce  the  lowest  possible  amount  of  smoke 
and  toxic  gases  as  specified  in  the  current  Federal  Air  Regulations? 
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